-1

During manual unpacking, the first task is to find to original entry point. The program jumps there after the unpacking is done. I took the bin/ls file, and checked with readelf -h that the entry point is 0x404870. I packed it with upx, and in gdb set a breakpoint at this address: b *0x404870. I expected that the program will stop there, but apparently it terminates without stopping at this address. Am I misinterpreting something?

  • there is no guarantee that the packer will use the same entry point it can write the unpacked stuff to any section and jump haywire over hoops and loops to trick you into failing. btw you are on wrong track when you are in the unpacking world you wont have access to original unpacked binary to set any predetermined breakpoints so read up and start unpacking manually – blabb Dec 10 '15 at 12:22
  • I know that I won't have access to the original unpacked binary. All the tutorials are for 32 bit Windows, I am on 64bit linux. I just want to get to the point when the code reaches the original entry point. Isn't the esp trick (used by the tutorials I have found) assuming that the packer uses the same entry point? – robert Dec 10 '15 at 12:30
  • no, the esp trick is used to allow an arbitrary entrypoint value, by watching for the write to the esp, which you can then examine, and then set a breakpoint at the true entrypoint. – peter ferrie Dec 10 '15 at 16:55
  • Another reason your approach might not work is if your target was compiled as a position-independent executable. – Jason Geffner Dec 10 '15 at 20:33
  • Somebody is downvoting all my questions without a comment. – robert Feb 20 '16 at 20:46
0

Your approach doesn't make much sense, since the packer is free to move the original executable around and to map it at a different offset.

Old version of upx on Linux just wrote the file to a temporary location, then execve'd it, but I think that modern ones are now writing it in memory : You can find the OEP by breaking on stack/heap execution in GDB, like everyone is doing on Windows with OllyDBG.

-1

My idea is to use LordPE to find what's packed with. Once you have unpacked it, ImportREC can help reconstruct your executable without the packer. I don't know what you 're dealing with, but if you check out a video of how each of them work and get the basics, you will most likely succeed.

  • Unfortunately as far as I see these are for Windows. – robert Dec 10 '15 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.