As a first unpacking exercise, I decided to try to unpack the famous UPX (without using upx -d of course). I chose an executable I had somewhere, built from C++ code in debug mode. I packed it using the last version of upx upx algorithm.exe and tested it.

I set a hardware breakpoint after PUSHAD and after I hit it, I dumped the process with OllydumpEx. Finally I used Scylla to rebuild the IAT.

There was no error during the whole process but my fixed dump terminate with a Segmentation Fault. What would you do to investigate what went wrong?

This picture shows the disassembly windows where I paused to dump, and the options used during the process. enter image description here

Edit:

I just checked in the process memory and the IAT VA and size found b Scylla seem to be correct.

up vote 4 down vote accepted

You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed.

Easiest solution is to disable ASLR and then unpack. If you want to disable ASLR on the packed executable, edit the IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE flag of the DLL Characteristics field using a PE editor of your choice. Another option is to disable ASLR on the system which is not recommended.

  • Disabling ASLR with a PE editor allowed to produce a working unpacked executable. Thanks a lot! – Stud Nov 6 at 21:44
  • 1
    Could you elaborate on why it affects relocation in this situation? – Stud Nov 6 at 21:54

Just set a breakpoint in 0x00ef674c.

enter image description here

Press F9.

When it hit the breakpoint, press F7 to go the original Entrypoint of the unpacked file.

Just make sure that the EIP is the OEP.

enter image description here

  • I tried to follow the jump and set 00A8114A as the entry point as you suggested, it doesn't change anything. By the way, the jump leads to a jump table. It doesn't look like an entry point to me. Here is a screenshot: framapic.org/DlaGeM6XRrbL/zJbd2cEtYqr9.JPG – Stud Nov 5 at 20:14
  • @Stud The Original Entrypoint must be 0x00ed114a. Please see the screenshot. This is an example of packed calc.exe and original calc.exe. framapic.org/puYO0dYjWhiO/dZJfxKYwl0TF.png – Llallum Nov 6 at 6:05
  • The base address must have changed between my tests, but I assure you that the jump on your screenshot leads to the screenshot in my first comment. According to all tutorials and to you I do this correctly, I still don't understand why it doesn't work... – Stud Nov 6 at 6:41

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.