2

I did a brief survey on malware unpacking and I found several theses on automated general unpacking:Eureka, PolyUnpack, omniUnpack, Malware Normalization.

However, these theses are written years ago and I don't think these methods still work. A basic assumption of these methods is an unpacker routine restore whole protected code at a time. Thus, we can get original code dumping a certain memory region when an unpacker routine finishes its work.

When it comes to more sophisticated packer (such as Maya's veil), it doesn't reveal whole protected code. As far as I know an attempt to attack this problem is to distinguish between code that performs unpacking routine and code does not and I think this is not really unpacking.

Only way to unpacking sophisticated packers is manually reversing it?

Thank you.

Improve this question
1
  • 1
    Even though there is sophisticated malware out there, there is always unsophisticated malware for which those old techniques might still work.
    – mrexodia
    Sep 15, 2018 at 17:24

1 Answer 1

Reset to default
2

You actually have more than one option in this case:

  1. RE of sophisticated packer

  2. Wait for someone else to RE the sophisticated packer and publish the method/tool. Maybe ask in this community?

  3. Ask the author of sophisticated packer to provide the unpacker [buy one?]

  4. Ask the author of packed program to provide it to you with no sophisticated packer applied.

Hope it help :)

D.L.

Improve this answer
3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.