You can easily unpack MPRESS packed binary manually, this process can be applied to many more packers such as UPX etc. with minimal changes.
I assume you are familiar with debugger and breakpoints(bp). Since you have not provided any instruction snippets or disassembly, I will try to wrap up process in few points in abstract way, though it will be cumbersome but bear with me:
- Reach the entry point of your PE by setting a breakpoint, you may need to change some settings in debugging options if you initially reach system library breakpoint.
- Now, by this time you have reached bp on entry point, Press F8(step over) one or two time. On CPU register window set hardware breakpoint on
- Now with hardware bp set in step 2, Press F9(run) and you will reach hardware breakpoint and will be shown in disassembly.
- Now you only have to use F8 as will have to reach the
OEP(Original Entry Point), therefore using F8 execute instructions step by step, you will notice a
jmpinstruction which will take you to
OEPof your PE.
- Use Scylla or similar program to dump the current process(your packed program) and fix the import table of the dumped process. Now you have a unpacked MPRESS Portable executable.
I know we haven't discussed working of MPRESS and few other details but that would make answer very long and unnecessary given the fact you have not provided disassembly.