I'm trying to unpack a small application I compiled with VS2015 (v140_xp) and packed with UPX 3.93 (option -1). The application checks for
IsDebuggerPresent and uses
std::cout, nothing fancy. The packed executable works fine in the VM.
I followed the classic
pushad / popad / jump process I learned to reach the OEP. Then I tried to dump, set the EP and rebuild the imports.
Sadly, the dumped executable crashes when I start it, no matter what tools I used (dump with ollyDump or LordPE, build imports with ollydump or imprec).
The error thrown is: The Application Was Unable To Start Correctly with the error code 0xc0000005
This is the first packed executable I actually try to unpack myself and despite all the articles I read, I don't really know where to look now.
EDIT: Opening the dumped file with CFF explorer confirms that the EP is set to the address of the jump after
popad. Opening the dumped file with IDA, I can see the string I passed to std::cout (but IDA complains when analysing the executable).