How to prevent "upx -d" on an UPX packed executable?

Question

I recently read a tweet from Ange about a technique to fool UPX when the option -d (decompress) is called.

I would like to know how this is working and, what are the technique to prevent an UPX packed executable to be decompressed through upx -d (if possible for, both, Linux and Windows).

Answer 1

UPX doesn't check the unpacking stub's integrity, and just blindly restores the data from the stored information, not from the actual execution.

Since UPX is open-source and documented (commented IDB), it's easy to modify its and actually do something extra (anti-debug, patch, decryption, jump to real entrypoint...) that will be lost when 'upx -d' is used.

Such UPX hack is not uncommon in malware.

Answer 2

Fooling upx -d can be as simple as one byte patch here is a small sample.

Pack the MS-Windows standard calc.exe, hexedit one byte and result is an undepackable executable with upx -d (this is not corrupting the exe, the exe will run and can be unpacked manually). Only unpacking with the -d switch wont work.

1. create a new folder foolupx:

    foolupx:\>md foolupx
   

2. copy calc.exe to the newly created folder:

    foolupx:\>copy c:\WINDOWS\system32\calc.exe foolupx\upxedcalc.exe
        1 file(s) copied.
   

3. pack the renamed calc.exe:

    foolupx:\>upx .\foolupx\upxedcalc.exe
    Ultimate Packer for eXecutables
    Copyright (C) 1996 - 2011
    UPX 3.08w       Markus Oberhumer, Laszlo Molnar & John Reiser   Dec 12th 2011
   
        File size         Ratio      Format      Name
       --------------------   ------   -----------   -----------
         114688 ->     56832   49.55%    win32/pe     upxedcalc.exe
   
    Packed 1 file.
   

4. Create a duplicate of the packed calc.exe for hexediting and compare the files. The difference is one byte in the PE header section named UPX0 changed to BPX0:

    foolupx:\>copy .\foolupx\upxedcalc.exe .\foolupx\modupxedcalc.exe
        1 file(s) copied.
   
    foolupx:\>fc .\foolupx\upxedcalc.exe .\foolupx\modupxedcalc.exe
    Comparing files .\FOOLUPX\upxedcalc.exe and .\FOOLUPX\MODUPXEDCALC.EXE
    000001E8: 55 42
   

5. Uncompress both files with the -d switch. One will be unpacked, the other will not be unpacked:

    foolupx:\>upx -d .\foolupx\modupxedcalc.exe
    Ultimate Packer for eXecutables
    Copyright (C) 1996 - 2011
    UPX 3.08w       Markus Oberhumer, Laszlo Molnar & John Reiser   Dec 12th 2011
   
        File size         Ratio      Format      Name
       --------------------   ------   -----------   -----------
        upx: .\foolupx\modupxedcalc.exe: CantUnpackException: file is modified/hacked/protected; take care!!!
   
    Unpacked 0 files.
   
    foolupx:\>upx -d .\foolupx\upxedcalc.exe
    Ultimate Packer for eXecutables
    Copyright (C) 1996 - 2011
    UPX 3.08w       Markus Oberhumer, Laszlo Molnar & John Reiser   Dec 12th 2011
   
          File size         Ratio      Format      Name
     --------------------   ------   -----------   -----------
     114688 <-     56832   49.55%    win32/pe     upxedcalc.exe
   
    Unpacked 1 file.
   
    foolupx:\>