my name is eleven and I'm new to reverse engineering and I have a question.

after scanning my program I have wanted to reverse engineer I have walked into a problem.


this is a program I'm trying to figure out if its vmprotect or upx. after scanning with detect it easy it pops up with vmprotect yet after looking pestudio it came with upx seen in this screenshot.


any help on this?

  • Having ".UPX*" sections point at UPX. But generally speaking, it is possible to pack an executable with more that one packer. I tend to believe that if some tools identify it as vmprotect even though there are obvious signs that it is UPX, then these tools' analysis is probably more thorough and they are correct. – Yotamz Mar 21 at 22:08
  • thank you! this explains many of the executable I have looked through. – eleven Mar 23 at 0:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.