How to unpack kkrunchy executables?

Question

I'm trying to figure out how to unpack kkruncy executable, sources here and binaries here, anyone knows how to do it?

My main idea was testing out some little hello world exes compressed with kkrunchy but for some reason the exes will crash. Ie:

#define UNICODE

#include <windows.h>

void start()
{
    MessageBox(NULL, L"X", L"Y", MB_OK);
}

or:

global start
; kernel32.lib Exports
extern _ExitProcess@4
extern _GetStdHandle@4
extern _WriteFile@20

section .text

start:
    ; DWORD  bytes;
    mov     ebp, esp
    sub     esp, 4

    ; hStdOut = GetstdHandle( STD_OUTPUT_HANDLE)
    push    -11
    call    _GetStdHandle@4
    mov     ebx, eax

    ; WriteFile( hstdOut, message, length(message), &bytes, 0);
    push    0
    lea     eax, [ebp-4]
    push    eax
    push    (message_end - message)
    push    message
    push    ebx
    call    _WriteFile@20

    ; ExitProcess(0)
    push    0
    call    _ExitProcess@4

    ; never here
    hlt
message:
    db      'Hello', 10, 13, 0
message_end:

I've used the default parameters but the executables are broken. In any case, how could i figure out how to unpack kkrunchy executables?

Answer 1

For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip.

Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option to say Ctrl+/.

Next up, press G (for graph) and you should see the return blocks marked in red.

Put a breakpoint on both of them, run, step and you will notice a function with a suspiciously large graph...

Now go ahead and use that Trace into beyond trace record function to keep stepping through while skipping the instructions that were already traced over. You will quickly notice that this algorithm is exhausting the (default) 50000 step count and a bit of clicking around will tell you where the loop condition is.

Put a hardware breakpoint on that destination, run and you should see the original entry point.

Next up open Scylla Ctrl+I, hit IAT Autosearch, OK, Get Imports, Dump, Fix Dump and you have an unpacked executable. I will leave it upto you to properly clean out the garbage from that dump...