1

I had a sample which was packed by a packer and I unpacked it using OllyDbg but after unpacking still IDA can not resolve the section and show most of instructions as DD.

Is this sample still packed maybe for second round? and how can I resolve sections in IDA pro?

1 Answer 1

1

You either incorrectly dumped the unpacked PE, or incompletely unpacked as you suggested.

Using ollydbg plugins like OllyDumpEx you can fine-tune the resulting dump. It is crucial to find the original entry point and make sure all relevant code is properly unpacked before performing the dump.

You can easily tell if you successfully dumped a region by looking at it. If you can see reasonable and logical assembly in olly after you unpacked, you can be pretty sure that region is unpacked. You should make sure the entire PE is unpacked before dumping.

If you're convinced you successfully unpacked the PE, you should make sure OllyDumpEx (or similar) plugin's configuration is set correctly. You can get invalid PEs when dumping with incorrect values. Most dumping utilities have tutorials that go over all of the plugin's configuration parameters to make sure you're using them correctly.

Attempting to tackle tutorials and crackmes, specifically ones with available solutions is a good way to learn how to use the more advanced features of most dumping utilities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.