3

Seems like unpacking UPX manually is not a trivial task any more, due to ASLR and the need to recover the relocation table. So, before reinventing the wheel, I'd like to know if there's already some tool to do this.

1

There is a tool called ReloX by MackT/uCF2000:

Purpose:

ReloX is a Win32 relocations rebuilder. It will create a .reloc section from different based images.

What does it need?

  • At least 2 different based images of a module. The more you have images, the more your relocations will be reliable.

Limitations

  • It will only support 32 bits relocations of type (3). (IMAGE_REL_BASED_HIGHLOW : The fixup applies the delta to the 32-bit field at Offset)

At the time of writing, a copy seems to be available here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.