If you compare the hash values of original/unpacked files, then they are different since upx -d
does not restore bit-by-bit of the original file. Indeed, UPX
parses the original file and keeps only information so that the packed data, after being unpacked, can be executed exactly the same as the original one, i.e. the original/unpacked files are semantically equivalent but not physically equivalent^^.
That is understandable since there is information that not affect to the execution of the binary, a trivial instance is the data between the end of DOS stub and the begin of PE header. For more detail, you may refer to the function pack
of the class, for example, PackW32Pe
(in p_w32pe.h/cpp
) for PE and the function unpack
of the class Packer
(in packer.h/cpp
).
For example, we can see that UPX
modifies the (DOS and PE) header of the unpacked file using the following code (I have renamed some variables for more comprehensible). First, it decompresses and extracts the header:
// decompress
decompress(input_buffer, output_buffer);
upx_byte *extrainfo = output_buffer + get_le32(output_buffer + ph.u_len - 4);
memcpy(&output_header, extrainfo, sizeof (output_header));
then modifies slightly the header:
...
output_header.headersize = rvamin;
output_header.chksum = 0;
//NEW: disable reloc stripping if ASLR is enabled
if(input_header.dllflags & IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE)
opt->win32_pe.strip_relocs = false;
// FIXME: ih.flags is checked here because of a bug in UPX 0.92
if ((opt->win32_pe.strip_relocs && !isdll) || (input_header.flags & RELOCS_STRIPPED))
{
output_header.flags |= RELOCS_STRIPPED;
ODADDR(PEDIR_RELOC) = 0;
ODSIZE(PEDIR_RELOC) = 0;
}
// write decompressed file
if (output_file)
{
...
upx -d
then we receive the same binary as before packed (since this procedure does not depend on the unpacking stub embedded in the packed binary)? Otherwise, if we let the stub unpack the binary, then the received binary is different (either we need fix IAT and OEP, or the stub is not standard, then it can modify the packed data)