4

As a first unpacking exercise, I decided to try to unpack the famous UPX (without using upx -d of course). I chose an executable I had somewhere, built from C++ code in debug mode. I packed it using the last version of upx upx algorithm.exe and tested it.

I set a hardware breakpoint after PUSHAD and after I hit it, I dumped the process with OllydumpEx. Finally I used Scylla to rebuild the IAT.

There was no error during the whole process but my fixed dump terminate with a Segmentation Fault. What would you do to investigate what went wrong?

This picture shows the disassembly windows where I paused to dump, and the options used during the process. enter image description here

Edit:

I just checked in the process memory and the IAT VA and size found b Scylla seem to be correct.

Improve this question

2 Answers 2

Reset to default
8

You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed.

Easiest solution is to disable ASLR and then unpack. If you want to disable ASLR on the packed executable, edit the IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE flag of the DLL Characteristics field using a PE editor of your choice. Another option is to disable ASLR on the system which is not recommended.

Improve this answer
2
  • 1
    Disabling ASLR with a PE editor allowed to produce a working unpacked executable. Thanks a lot!
    – Stud
    Commented Nov 6, 2018 at 21:44
  • 1
    Could you elaborate on why it affects relocation in this situation?
    – Stud
    Commented Nov 6, 2018 at 21:54
3

Just set a breakpoint in 0x00ef674c.

enter image description here

Press F9.

When it hit the breakpoint, press F7 to go the original Entrypoint of the unpacked file.

Just make sure that the EIP is the OEP.

enter image description here

Improve this answer
3
  • I tried to follow the jump and set 00A8114A as the entry point as you suggested, it doesn't change anything. By the way, the jump leads to a jump table. It doesn't look like an entry point to me. Here is a screenshot: framapic.org/DlaGeM6XRrbL/zJbd2cEtYqr9.JPG
    – Stud
    Commented Nov 5, 2018 at 20:14
  • @Stud The Original Entrypoint must be 0x00ed114a. Please see the screenshot. This is an example of packed calc.exe and original calc.exe. framapic.org/puYO0dYjWhiO/dZJfxKYwl0TF.png
    – ismael_akez
    Commented Nov 6, 2018 at 6:05
  • The base address must have changed between my tests, but I assure you that the jump on your screenshot leads to the screenshot in my first comment. According to all tutorials and to you I do this correctly, I still don't understand why it doesn't work...
    – Stud
    Commented Nov 6, 2018 at 6:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.