Problems with relocation when unpacking

Question

I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly.

I started with compressing my simple x64.exe with UPX and attempted to manually unpack it.

I stepped through the stub code, established where the extracted original code goes (.UPX0 section), found the OEP and IAT. With this, I was able to use Scylla to dump the process and correctly rebuild the IAT.

However, when I ran the unpacked exe it failed. I decided to debug the unpacked exe and realised the code attempts to address a static variable that was originally stored in the .data section but is now invalid and generates a memory violation exception (crashing the program).

Anyway to my frustration I realised that I needed to fix up the relocations as the original .reloc section had been lost. I painstakingly stepped through the UPX code and identified where the addresses that needed to be relocated were. I use PE explorer to rebuild the .reloc section manually. However, I gave up after 6 address when I realised there was a total of 100 to go through!

My question is, is there a tool that can automatically fix up the relocations (much like Scylla does with the IAT) or am I stuck doing it manually?

Many thanks Z

Answer 1

i found a tool for unpacking UPX x64.exe it work for me. it is called XVolkolak v0.22 i found it here: http://ntinfo.biz/index.html its a universal tool so it can unpack other packers to. Good luck. Have a nice day.

Answer 2

AFAIK there is no existing tool but you should be able to create one using the approach used by DOS unpackers:

1. Run the binary once, dump it at the entry point
2. Run it second time, forcing the load base to be different (e.g. map some memory at the preferred load base, or reboot to reinitialize ASLR). Capture a second dump.
3. Compare two dumps. The locations with differences should be the relocations. Create a relocation table for them.

Specifically for UPX, there’s an easier way: the relocation table is stored in a predefined format so you just need to find and parse it. See the UPX source code for more info.

Answer 3

Note that you do not have to take care of relocations if you just hard code the image base and remove the .reloc section.

Typically EXE files didn't use to be relocatable at all because they don't need to because they have their own address space. With the introduction of ASLR, EXE files got a .reloc table for security but they still work just as well without one.

So if you have a dump of a file that has been relocated, just "fix" that image base in the PE header and remove the .reloc section and your binary should work.