Anyone know of any publicly available modified versions of UPX for ELF? I.e. one that is not able to be unpacked using upx -d. The unpacking stub in the binary is slightly obfuscated. I am looking to identify the source of these modifications.

  • Please give more details - I am not aware of such a list. – Ange Nov 7 '13 at 6:52
  • 1
    Jason, this had to do with reverse engineering because unpacking binaries and indentifiying the packer is reverse engineering. – Raindog Nov 7 '13 at 18:49
  • but your question is just about a list (not unpacking or identifying), thus we can't contribute in that direction. – Ange Nov 7 '13 at 19:54

UPX is already managing ELF (see: UPX supported executable formats). Or, did I miss the point of your question ?

But, note that UPX is not designed for obfuscation purpose, it mainly aims at compressing the executable.

  • I know it supports ELF. I have a binary that used a modified version of UPX in that the compression schemes, but that the unpacking stub is slightly obfuscated. – Raindog Oct 25 '13 at 1:58
  • 1
    I better understand your question now. But, the best way to have an accurate answer would be to show the modification you found and/or part or the whole asm code of the packer prelude. – perror Oct 25 '13 at 11:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.