2

Firstly, thank you for your answer.

What is the best unpacking tool to use to unpack - UPX 0.89.6 - 1.02 / 1.05 - 1.24 ->[Overlay] could you please provide a link so i can obtain as such.

Thank you.

1

2 Answers 2

3

upx itself unpacks binaries. Pass the -d option on the command line.

Example on a linux box

$ file exa
exa: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), statically linked, stripped
$ xxd exa | grep UPX
000000e0: 1000 0000 0000 0000 a8aa 40f7 5550 5821  [email protected]!
000a09c0: 6520 5550 5820 6578 6563 7574 6162 6c65  e UPX executable
000a09f0: 3a20 5550 5820 332e 3934 2043 6f70 7972  : UPX 3.94 Copyr
000a0a10: 3137 2074 6865 2055 5058 2054 6561 6d2e  17 the UPX Team.
000a0c70: 1485 d275 1581 fe55 5058 2175 115e 7d00  ...u...UPX!u.^}.
001142d0: 5058 2100 0000 0000 5550 5821 0d16 0807  PX!.....UPX!....
$ upx -d exa
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2017
UPX 3.94        Markus Oberhumer, Laszlo Molnar & John Reiser   May 12th 2017

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
   3338040 <-   1131260   33.89%   linux/amd64   exa

Unpacked 1 file.
$ file exa
exa: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a1c771fd094e61d2d8fbdab6b688141bfb8b6e30, with debug_info, not stripped
1

If the UPX header was intentionally broken after packing, you can give a try to this tool to restore it : https://github.com/NozomiNetworks/upx-recovery-tool

1
  • Hi and welcome to RE.SE. NB: This helps only for ELF files, so probably won't help for Windows (PE files).
    – 0xC0000022L
    Oct 4, 2023 at 11:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.