I recently read a tweet from Ange about a technique to fool UPX when the option -d (decompress) is called.

I would like to know how this is working and, what are the technique to prevent an UPX packed executable to be decompressed through upx -d (if possible for, both, Linux and Windows).

  • Of course @blabb's answer prevents upx -d but you should be aware that Generic Unpackers such as RL Depacker can still unpack such files. – 0xec Feb 8 '14 at 7:45
up vote 12 down vote accepted

UPX doesn't check the unpacking stub's integrity, and just blindly restores the data from the stored information, not from the actual execution.

Since UPX is open-source and documented (commented IDB), it's easy to modify its and actually do something extra (anti-debug, patch, decryption, jump to real entrypoint...) that will be lost when 'upx -d' is used.

Such UPX hack is not uncommon in malware.

  • If I get it right, it only requires to modify the checksum of the packed executable... Or did I misunderstood something ? – perror Dec 30 '13 at 13:47
  • @perror did you figure this out? – Tiago Sep 27 '16 at 12:08
  • I appeared to be true (at the time I tested it). So, modifying the checksum of the executable won't prevent to execute it, but will render the decompression a bit more difficult (because you need to bypass this checksum verification before applying the decompression). – perror Sep 27 '16 at 13:22

Fooling upx -d can be as simple as one byte patch here is a small sample.

Pack the MS-Windows standard calc.exe, hexedit one byte and result is an undepackable executable with upx -d (this is not corrupting the exe, the exe will run and can be unpacked manually). Only unpacking with the -d switch wont work.

  1. create a new folder foolupx:

    foolupx:\>md foolupx
    
  2. copy calc.exe to the newly created folder:

    foolupx:\>copy c:\WINDOWS\system32\calc.exe foolupx\upxedcalc.exe
        1 file(s) copied.
    
  3. pack the renamed calc.exe:

    foolupx:\>upx .\foolupx\upxedcalc.exe
    Ultimate Packer for eXecutables
    Copyright (C) 1996 - 2011
    UPX 3.08w       Markus Oberhumer, Laszlo Molnar & John Reiser   Dec 12th 2011
    
        File size         Ratio      Format      Name
       --------------------   ------   -----------   -----------
         114688 ->     56832   49.55%    win32/pe     upxedcalc.exe
    
    Packed 1 file.
    
  4. Create a duplicate of the packed calc.exe for hexediting and compare the files. The difference is 1 byte in the PE header section named UPX0 chained to BPX0:

    foolupx:\>copy .\foolupx\upxedcalc.exe .\foolupx\modupxedcalc.exe
        1 file(s) copied.
    
    foolupx:\>fc .\foolupx\upxedcalc.exe .\foolupx\modupxedcalc.exe
    Comparing files .\FOOLUPX\upxedcalc.exe and .\FOOLUPX\MODUPXEDCALC.EXE
    000001E8: 55 42
    
  5. Uncompress both files with the -d switch. One will be unpacked, the other will not be unpacked:

    foolupx:\>upx -d .\foolupx\modupxedcalc.exe
    Ultimate Packer for eXecutables
    Copyright (C) 1996 - 2011
    UPX 3.08w       Markus Oberhumer, Laszlo Molnar & John Reiser   Dec 12th 2011
    
        File size         Ratio      Format      Name
       --------------------   ------   -----------   -----------
        upx: .\foolupx\modupxedcalc.exe: CantUnpackException: file is modified/hacked/protected; take care!!!
    
    Unpacked 0 files.
    
    foolupx:\>upx -d .\foolupx\upxedcalc.exe
    Ultimate Packer for eXecutables
    Copyright (C) 1996 - 2011
    UPX 3.08w       Markus Oberhumer, Laszlo Molnar & John Reiser   Dec 12th 2011
    
          File size         Ratio      Format      Name
     --------------------   ------   -----------   -----------
     114688 <-     56832   49.55%    win32/pe     upxedcalc.exe
    
    Unpacked 1 file.
    
    foolupx:\>
    

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.