I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly.
I started with compressing my simple x64.exe with UPX and attempted to manually unpack it.
I stepped through the stub code, established where the extracted original code goes (.UPX0 section), found the OEP and IAT. With this, I was able to use Scylla to dump the process and correctly rebuild the IAT.
However, when I ran the unpacked exe it failed. I decided to debug the unpacked exe and realised the code attempts to address a static variable that was originally stored in the .data section but is now invalid and generates a memory violation exception (crashing the program).
Anyway to my frustration I realised that I needed to fix up the relocations as the original .reloc section had been lost. I painstakingly stepped through the UPX code and identified where the addresses that needed to be relocated were. I use PE explorer to rebuild the .reloc section manually. However, I gave up after 6 address when I realised there was a total of 100 to go through!
My question is, is there a tool that can automatically fix up the relocations (much like Scylla does with the IAT) or am I stuck doing it manually?
Many thanks Z