1

I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe with PE Explorer is showed the regular header section (.txt .data ... ) Dose PE Explorer unpack packed files before analyze it? what if I want to view the packed exe with PE Explorer?

4
  • Use another software? PEview or CFF Explorer come to mind May 29, 2017 at 21:32
  • PE Explorer ships with the UPX Unpacker plug-in see this heaventools.com/PE_Explorer_plug-ins.htm, to disable the UPX Unpacker plug-in from the Tools menu Select Plug-in Manager, now Select UPX Unpacker plug-in and set the value to zero to disables the plug-in and marks it red.
    – adrián
    May 30, 2017 at 0:28
  • @Dillinur: Thanx, I don't know CFF, but I'll give it a try May 30, 2017 at 14:59
  • @adrián Perfect, why u didn't post it as an answer? May 30, 2017 at 14:59

1 Answer 1

1

The product overview of PE Explorer states in several places that it will load PE files that are compressed with UPX.

Open UPX-, Upack- and NsPack-compressed files seamlessly in PE Explorer, without long workarounds

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.