2

I did a brief survey on malware unpacking and I found several theses on automated general unpacking:Eureka, PolyUnpack, omniUnpack, Malware Normalization.

However, these theses are written years ago and I don't think these methods still work. A basic assumption of these methods is an unpacker routine restore whole protected code at a time. Thus, we can get original code dumping a certain memory region when an unpacker routine finishes its work.

When it comes to more sophisticated packer (such as Maya's veil), it doesn't reveal whole protected code. As far as I know an attempt to attack this problem is to distinguish between code that performs unpacking routine and code does not and I think this is not really unpacking.

Only way to unpacking sophisticated packers is manually reversing it?

Thank you.

  • 1
    Even though there is sophisticated malware out there, there is always unsophisticated malware for which those old techniques might still work. – mrexodia Sep 15 '18 at 17:24
2

You actually have more than one option in this case:

  1. RE of sophisticated packer

  2. Wait for someone else to RE the sophisticated packer and publish the method/tool. Maybe ask in this community?

  3. Ask the author of sophisticated packer to provide the unpacker [buy one?]

  4. Ask the author of packed program to provide it to you with no sophisticated packer applied.

Hope it help :)

D.L.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.