How to check if an ELF file is UPX packed?

Question

I have an ELF file and want to know if it is UPX packed. How can I detect UPX compression in GNU/Linux?

Answer 1

Okay, assuming vanilla UPX you should be fine by detecting the strings UPX! or UPX0. As far as I remember this would also work on Windows.

So it's a shell one-liner such as:

grep UPX\! <filename>

or

grep UPX0 <filename>

... assuming the GNU version of grep here.

---

Another method, but using the same principle:

$ hexdump -C <filename> |grep -C 1 UPX
000000a0  00 00 00 00 00 00 00 00  00 00 20 00 00 00 00 00  |.......... .....|
000000b0  c3 af e9 18 55 50 58 21  20 08 0d 16 00 00 00 00  |....UPX! .......|
000000c0  a0 fd 16 00 a0 fd 16 00  38 02 00 00 c6 00 00 00  |........8.......|
--
0000cf60  fe 61 03 83 78 b5 54 03  67 8b 85 2d ca a8 12 3c  |.a..x.T.g..-...<|
0000cf70  44 ad bc 12 ab 7e 86 55  50 58 30 0e 01 ee 7c 64  |D....~.UPX0...|d|
0000cf80  00 f7 d1 80 4a 11 03 58  6e ac 0d 01 ff 92 83 e8  |....J..Xn.......|
--
000544e0  73 20 66 69 6c 65 20 69  73 20 70 61 63 6b 65 64  |s file is packed|
000544f0  20 77 69 74 68 20 74 68  65 20 55 50 58 20 65 78  | with the UPX ex|
00054500  65 63 75 74 61 62 6c 65  20 70 61 63 6b 65 72 20  |ecutable packer |
00054510  68 74 74 70 3a 2f 2f 75  70 78 2e 73 66 2e 6e 65  |http://upx.sf.ne|
00054520  74 20 24 0a 00 24 49 64  3a 20 55 50 58 20 33 2e  |t $..$Id: UPX 3.|
00054530  30 38 20 43 6f 70 79 72  69 67 68 74 20 28 43 29  |08 Copyright (C)|
--
00054e40  7d 24 24 92 b7 0c 7f 12  01 a8 24 49 92 ff 00 00  |}$$.......$I....|
00054e50  00 00 55 50 58 21 00 00  00 00 00 00 55 50 58 21  |..UPX!......UPX!|
00054e60  0d 16 08 07 80 44 b5 80  b9 9a 8a d9 a0 08 00 00  |.....D..........|

Answer 2

I do not recommend you to rely on the strings or section names you may find. Normally, it will indicate that the file is packed with UPX but, specially if you're analyzing malware, it may be done in order to fool you. My recommendation is to look to the entry point and find a pattern similar to this one:

0x00023b60 ; FUNCTION start
0x00023b60 (01) 60                     PUSHA 
0x00023b61 (05) be00904300             MOV ESI, 0xHARDCODED_VIRTUAL_ADDRESS
0x00023b66 (06) 8dbe0080fcff           LEA EDI, [ESI-0x38000] 
0x00023b6c (01) 57                     PUSH EDI 
0x00023b6d (02) eb0b                   JMP 0x00023b7a   ; 1 

Basically, find for PUSHA, MOV ESI, VIRTUAL_ADDRESS, LEA and JMP.

Answer 3

In Linux/Unix variants, strings command has helped me identify some of the packers such as UPX, Aspack, NSPack, NTKrnl, PeCompact, Themida, etc., All these packers tend to leave embedded strings in the packed executable which helps identify the type of packer. Granted, the author of the elf file could introduce the very same strings intentionally to throw your analysis off-track. I would just use this as a starting point in my analysis.

Here are some of the identification strings that helped me identify the packer type.
UPX - UPX0, UPX1, UPX2
Aspack - aspack, adata
NSPack - NSP0, NSP1, NSP2
NTKrnl - NTKrnl Security Suite
PECompact - PEC2, PECompact2
Themida - Themida, aPa2Wa

Also, the file command identifies some common packer formats too.

If you suspect that the file is definitely packed with UPX, then I would recommend the suggestion from 0xC0000022L.

Answer 4

1. get UPX
2. make your own UPX-packed ELFs, with different options (LZMA, NRV,...)
3. As UPX is easy to modify, and very often modified, patched or even faked, comparing the code starts will make it easy to check if your target is indeed UPX-packed, and if this is truely the original UPX version or if it's modified in any way.