General unpacking of packed malware

Question

I did a brief survey on malware unpacking and I found several theses on automated general unpacking:Eureka, PolyUnpack, omniUnpack, Malware Normalization.

However, these theses are written years ago and I don't think these methods still work. A basic assumption of these methods is an unpacker routine restore whole protected code at a time. Thus, we can get original code dumping a certain memory region when an unpacker routine finishes its work.

When it comes to more sophisticated packer (such as Maya's veil), it doesn't reveal whole protected code. As far as I know an attempt to attack this problem is to distinguish between code that performs unpacking routine and code does not and I think this is not really unpacking.

Only way to unpacking sophisticated packers is manually reversing it?

Thank you.

Answer 1

You actually have more than one option in this case:

1. RE of sophisticated packer

2. Wait for someone else to RE the sophisticated packer and publish the method/tool. Maybe ask in this community?

3. Ask the author of sophisticated packer to provide the unpacker [buy one?]

4. Ask the author of packed program to provide it to you with no sophisticated packer applied.

Hope it help :)

D.L.