1

I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe with PE Explorer is showed the regular header section (.txt .data ... ) Dose PE Explorer unpack packed files before analyze it? what if I want to view the packed exe with PE Explorer?

  • Use another software? PEview or CFF Explorer come to mind – Dillinur May 29 '17 at 21:32
  • PE Explorer ships with the UPX Unpacker plug-in see this heaventools.com/PE_Explorer_plug-ins.htm, to disable the UPX Unpacker plug-in from the Tools menu Select Plug-in Manager, now Select UPX Unpacker plug-in and set the value to zero to disables the plug-in and marks it red. – adrián May 30 '17 at 0:28
  • @Dillinur: Thanx, I don't know CFF, but I'll give it a try – Ahmad Kouraiem May 30 '17 at 14:59
  • @adrián Perfect, why u didn't post it as an answer? – Ahmad Kouraiem May 30 '17 at 14:59
1

The product overview of PE Explorer states in several places that it will load PE files that are compressed with UPX.

Open UPX-, Upack- and NsPack-compressed files seamlessly in PE Explorer, without long workarounds

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.