2

I am working on getting better with concepts of unpacking manually to get more clarity on understanding packing routines and decryption logic, so I am trying a few tutorials on PESpin! Previously I worked with UPX & ASPack, any tutorials apart from this, will be appreciated, not looking for shortcuts like set a breakpoint, then jmp, then dump kind of stuffs . Thank you for reading this.

2

1 Answer 1

3

You don't need to care about the decrypting routine because a single packed binary can contain many decrypting routines and to analyse every single one of them is time consuming. So you need to utilise the fact that a packed program is packed not from source code but from a compiled binary which mean one way or the other, the decryption routine has to decrypt to some original binary and jump to it to execute.

There are two step in an unpacking process. The first is to find the Original Entry Point (OEP) of the program and the second is try to recover lost data (iat, steal entrypoint).

To find the OEP you can relies on these informations:

  • To jump to the OEP the program need to do a long jump (about 0x100 bytes difference) or a section jump after a decryption routine.
  • Because every program need to have a startup routine so if you can find when the startup routine get execute then you can find a candidate for OEP.

After you have found the OEP, you will need to recover obfuscated part of the packed binary (like IAT, stolen OEP, ...). Here is a hint for the IAT, you can trace where the obfuscated function which call the api and then build your own IAT and replace those call with the IAT call. And after that you can dump the binary and run it normally.

This is just a tip of the iceberg, each protector has it own unique way to pack and unpack, each version of the protector also has a new way too. So this is just a general tutorial but with each packed binary you have to adapt to the technique it use because there is no universal way to unpack a binary and it is mathematically proven to be true (check appendix of this paper: https://www.acsac.org/2006/papers/122.pdf).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.