0

I have a file that is protected by MPRESS packer and I want to know how to unpack it on Windows. Is there a specific program for that or something else? I am new to this so every help is appreciated.enter image description here

New contributor
LC0 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

1 Answer 1

0

You can easily unpack MPRESS packed binary manually, this process can be applied to many more packers such as UPX etc. with minimal changes.

I assume you are familiar with debugger and breakpoints(bp). Since you have not provided any instruction snippets or disassembly, I will try to wrap up process in few points in abstract way, though it will be cumbersome but bear with me:

  1. Reach the entry point of your PE by setting a breakpoint, you may need to change some settings in debugging options if you initially reach system library breakpoint.
  2. Now, by this time you have reached bp on entry point, Press F8(step over) one or two time. On CPU register window set hardware breakpoint on ebx register value.
  3. Now with hardware bp set in step 2, Press F9(run) and you will reach hardware breakpoint and will be shown in disassembly.
  4. Now you only have to use F8 as will have to reach the OEP(Original Entry Point), therefore using F8 execute instructions step by step, you will notice a jmp instruction which will take you to OEP of your PE.
  5. Use Scylla or similar program to dump the current process(your packed program) and fix the import table of the dumped process. Now you have a unpacked MPRESS Portable executable.

I know we haven't discussed working of MPRESS and few other details but that would make answer very long and unnecessary given the fact you have not provided disassembly.

2
  • Is there any other way without doing it manually?
    – LC0
    yesterday
  • @LCO, Sorry to say no, we don't have any other option as far as MPRESS is concerned we have to do it manually, though you can get unpackers programs for upx and some other packer. Initially I also faced same challenge but now it's not a big deal :-) yesterday

Your Answer

LC0 is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.