1

I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly.

I started with compressing my simple x64.exe with UPX and attempted to manually unpack it.

I stepped through the stub code, established where the extracted original code goes (.UPX0 section), found the OEP and IAT. With this, I was able to use Scylla to dump the process and correctly rebuild the IAT.

However, when I ran the unpacked exe it failed. I decided to debug the unpacked exe and realised the code attempts to address a static variable that was originally stored in the .data section but is now invalid and generates a memory violation exception (crashing the program).

Anyway to my frustration I realised that I needed to fix up the relocations as the original .reloc section had been lost. I painstakingly stepped through the UPX code and identified where the addresses that needed to be relocated were. I use PE explorer to rebuild the .reloc section manually. However, I gave up after 6 address when I realised there was a total of 100 to go through!

My question is, is there a tool that can automatically fix up the relocations (much like Scylla does with the IAT) or am I stuck doing it manually?

Many thanks Z

0

AFAIK there is no existing tool but you should be able to create one using the approach used by DOS unpackers:

  1. Run the binary once, dump it at the entry point
  2. Run it second time, forcing the load base to be different (e.g. map some memory at the preferred load base, or reboot to reinitialize ASLR). Capture a second dump.
  3. Compare two dumps. The locations with differences should be the relocations. Create a relocation table for them.

Specifically for UPX, there’s an easier way: the relocation table is stored in a predefined format so you just need to find and parse it. See the UPX source code for more info.

| improve this answer | |
  • good ideas, thanks, shame there isn't an easy tool – Zeller33 Jun 8 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.