How would I fully unpack UPX? It seems to me that unpacking it by dumping and fixing the IAT does not actually fix the section headers.

  • 1
    Hi and welcome to RE.SE. So do you want to use upx -d and it fails for some reason or are you set on using a memory dump of the executable? In the latter case - as you note - you will have to undo what the loader is (i.e. use file instead of image alignment, undo relocations - if possible - and so on ...).
    – 0xC0000022L
    Apr 19 '21 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.