How do I unpack a file protected by MPRESS?

Question

I have a file that is protected by MPRESS packer and I want to know how to unpack it on Windows. Is there a specific program for that or something else? I am new to this so every help is appreciated.

Answer 1

You can easily unpack MPRESS packed binary manually, this process can be applied to many more packers such as UPX etc. with minimal changes.

I assume you are familiar with debugger and breakpoints(bp). Since you have not provided any instruction snippets or disassembly, I will try to wrap up process in few points in abstract way, though it will be cumbersome but bear with me:

1. Reach the entry point of your PE by setting a breakpoint, you may need to change some settings in debugging options if you initially reach system library breakpoint.
2. Now, by this time you have reached bp on entry point, Press F8(step over) one or two time. On CPU register window set hardware breakpoint on esp register value.
3. Now with hardware bp set in step 2, Press F9(run) and you will reach hardware breakpoint and will be shown in disassembly.
4. Now you only have to use F8 as will have to reach the OEP(Original Entry Point), therefore using F8 execute instructions step by step, you will notice a jmp instruction which will take you to OEP of your PE.
5. Use Scylla or similar program to dump the current process(your packed program) and fix the import table of the dumped process. Now you have a unpacked MPRESS Portable executable. (Please don't forget to delete invalid imports in Scylla else unpacked file will refuse to run.)

I know we haven't discussed working of MPRESS and few other details but that would make answer very long and unnecessary given the fact you have not provided disassembly.