Still on my way to understand how to prevent the usage of the -d
(decompress) option of UPX (see this question), I try to identify the header file of UPX in ELF executable files.
Looking at the code, all the sources seems to be in the files lx_elf.h
and lx_elf.cpp
(stands for Linux Elf). I tried to follow the code but I got lost in it...
I also did take a look at the beginning of an UPX compressed executable file (amd64), visualized in 8-bytes per line mode for more clarity (and thanks to Corkami ELF-101):
00000000: 7f45 4c46 0201 0103 .ELF....
00000008: 0000 0000 0000 0000 ........
00000010: 0200 3e00 0100 0000 ..>.....
00000018: 0831 4200 0000 0000 .1B..... ELF HEADER
00000020: 4000 0000 0000 0000 @.......
00000028: 0000 0000 0000 0000 ........
00000030: 0000 0000 4000 3800 [email protected].
00000038: 0200 4000 0000 0000 ..@.....
00000040: 0100 0000 0500 0000 ........
00000048: 0000 0000 0000 0000 ........
00000050: 0000 4000 0000 0000 ..@.....
00000058: 0000 4000 0000 0000 ..@..... PROGRAM HEADER TABLE
00000060: f438 0200 0000 0000 .8......
00000068: f438 0200 0000 0000 .8......
00000070: 0000 2000 0000 0000 .. .....
00000078: 0100 0000 0600 0000 ........
00000080: 487d 0500 0000 0000 H}......
00000088: 487d 6500 0000 0000 H}e.....
00000090: 487d 6500 0000 0000 H}e.....
00000098: 0000 0000 0000 0000 ........
000000a0: 0000 0000 0000 0000 ........ UPX HEADER (???)
000000a8: 0000 2000 0000 0000 .. .....
000000b0: a298 b634 5550 5821 ...4UPX!
000000b8: f407 0d16 0000 0000 ........
000000c0: 1676 0500 1676 0500 .v...v..
000000c8: 0002 0000 bd00 0000 ........
000000d0: 0200 0000 fbfb 21ff ......!.
000000d8: 7f45 4c46 0201 0100 .ELF....
000000e0: 0200 3e00 0d70 2840 ..>..p(@
000000e8: 0f1b f26d 1605 00e8 ...m.... ELF HEADER (again)
000000f0: 6d05 0013 01eb be7b m......{
000000f8: 3800 0805 1c00 1b00 8.......
00000100: 060f 0527 9b90 27ec ...'..'.
00000108: 4000 4007 c001 0008 @.@.....
....8<....
My guess is that the second ELF header (always located at an offset of 0xd8
) is the header of the compressed executable. And indeed, when looking at the original ELF header of the executable (before applying upx
) we find:
00000000: 7f45 4c46 0201 0100 0000 0000 0000 0000 .ELF............
00000010: 0200 3e00 0100 0000 7028 4000 0000 0000 ..>.....p(@.....
00000020: 4000 0000 0000 0000 e86d 0500 0000 0000 @........m......
00000030: 0000 0000 4000 3800 0800 4000 1c00 1b00 [email protected]...@.....
00000040: 0600 0000 0500 0000 4000 0000 0000 0000 ........@.......
00000050: 4000 4000 0000 0000 4000 4000 0000 0000 @.@.....@.@.....
00000060: c001 0000 0000 0000 c001 0000 0000 0000 ................
00000070: 0800 0000 0000 0000 0300 0000 0400 0000 ................
00000080: 0002 0000 0000 0000 0002 4000 0000 0000 ..........@.....
A few fields have been omitted in the compressed version but the header is mainly preserved. So, lets assume this is just a short version of the original ELF header.
But, what I would like to understand are the fields of the first header:
00000080: 487d 0500 0000 0000 H}......
00000088: 487d 6500 0000 0000 H}e.....
00000090: 487d 6500 0000 0000 H}e.....
00000098: 0000 0000 0000 0000 ........
000000a0: 0000 0000 0000 0000 ........ UPX HEADER (???)
000000a8: 0000 2000 0000 0000 .. .....
000000b0: a298 b634 5550 5821 ...4UPX!
000000b8: f407 0d16 0000 0000 ........
000000c0: 1676 0500 1676 0500 .v...v..
000000c8: 0002 0000 bd00 0000 ........
000000d0: 0200 0000 fbfb 21ff ......!.
So, my question is about discovering the location and the meaning of the fields of the UPX header. If somebody knows about UPX internals any hint would be appreciated.
src/stub/src/include/linux.h
(search forUPX_MAGIC_LE32
) andheader.S
in the same directory. Don't have time to investigate beyond that, but if I was you I'd attach GDB and step through the disassembly line by line.