1

I'm trying to unpack a small application I compiled with VS2015 (v140_xp) and packed with UPX 3.93 (option -1). The application checks for IsDebuggerPresent and uses std::cout, nothing fancy. The packed executable works fine in the VM.

I followed the classic pushad / popad / jump process I learned to reach the OEP. Then I tried to dump, set the EP and rebuild the imports. Sadly, the dumped executable crashes when I start it, no matter what tools I used (dump with ollyDump or LordPE, build imports with ollydump or imprec).

The error thrown is: The Application Was Unable To Start Correctly with the error code 0xc0000005

This is the first packed executable I actually try to unpack myself and despite all the articles I read, I don't really know where to look now.

EDIT: Opening the dumped file with CFF explorer confirms that the EP is set to the address of the jump after popad. Opening the dumped file with IDA, I can see the string I passed to std::cout (but IDA complains when analysing the executable).

Improve this question
6
  • There isn't enough information to fulling understand the issue here. error code 0xC0000005 means there was an access violation, but there could be many reasons for that. You're probably making a tiny mistake in the process. Maybe you're debugging an ASLRed process and the entry point changes? Can you make sure the EP of the original packed executable stays the same in multiple spawns (restarting in a debugger doesn't count)?
    – NirIzr
    Apr 16, 2017 at 22:17
  • I made several attempts at dumping this executable and obtained the same OEP every time. I closed and opened the debugger again between each attempt. The OEP I find on the packed executable corresponds with the EP of the not packed version of the same executable (the first address where Ollydbg breaks when I load the not packed executable in it).
    – Stud
    Apr 16, 2017 at 22:28
  • I made some more tests and realized something I can't explain. Right after the jump that lead me to the OEP (I can confirm that this address is correct as I have the original application), I should have a completely unpacked executable right? But for some reason, Ollydbg can't show me readable strings in the "referenced strings" view. Knowing that I have at least one string used in the code that I should find in the list, what do you think it means?
    – Stud
    Apr 17, 2017 at 16:27
  • If you're using CPP and have your const strings as wstring objects olly won't find references to the strings as they're not directly referenced in the code (the wstring object is)
    – NirIzr
    Apr 17, 2017 at 17:05
  • 1
    Try x64dbg with the built in Scylla.
    – mrexodia
    Apr 17, 2017 at 21:45

1 Answer 1

Reset to default
-2

After unpacking, the program makes a long jump to the unpacked section of the code. This will be OEP.

PS: You can not just take OEP on it, it's purely a creative activity, especially for a beginner.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.