Seems like unpacking UPX manually is not a trivial task any more, due to ASLR and the need to recover the relocation table. So, before reinventing the wheel, I'd like to know if there's already some tool to do this.
There is a tool called
ReloX by MackT/uCF2000:
ReloX is a Win32 relocations rebuilder. It will create a .reloc section from different based images.
What does it need?
- At least 2 different based images of a module. The more you have images, the more your relocations will be reliable.
- It will only support 32 bits relocations of type (3). (IMAGE_REL_BASED_HIGHLOW : The fixup applies the delta to the 32-bit field at Offset)
At the time of writing, a copy seems to be available here.