I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad
and popad
instructions. I have a 64 bit executable, so I assume I have to look for a push and pop of all registers.
What I acieved until now is that I can get the entry point with readelf -h
, and set a breakpoint in gdb
at this address. With layout asm
I can follow the disassembled instructions too. As I understand at the popad
instruction the unpacking is done, and I can get the original entry point. However, because on 64bit there is no popad
, I am not sure where the original entry point will be. All registers will be popped or only a few?
I also do not know how to fix imports.
JMP
followed by a long trail of null (00
) bytes. The destination of theJMP
is the OEP. Illustrated here: deamonftp.free.fr/deamoncrack/Tuts/Kef/UPX/Cours%20upx_fichiers/… (Obviously, you won't be using OllyDbg, but the same approach can be used on Linux.)