2

I've decided to reverse this crackme. Obviously it's packed. I was told by PeID that there is only UPX inside. Ok, but upx -d simple crashed that's why I've concluded that this UPX may be scrambled somehow.

IDA warning

Binary didn't run properly in debugger(windbg) for unpacking it so I've dumped exe from working process and tried to fix imports. Maybe I should have tried Olly with plugins? However IDA still warns me that some imports might be destroyed(see picture). My question is: did I unpacked it correctly? If no what else should I do to unpack it?

Unpacked

5

Here you can find bunch of tools for unpacking upx. One of them(Upx Unpacker 0.2) solved my issue. Every unpacker should be used in specific case and this list may be incomplete.

  • 1
    Thanks for sharing. upx ("UPX 3.08w") is the one that worked for me. – user966939 Jan 15 '17 at 9:45
  • 2
    There is a massive number of positive detections in those archives. Be extremely warey if you download! virustotal.com/en/file/… – rolls Jul 5 '17 at 5:16
2

You should try to unpack it manually and reconstruct the IAT. With UPX, it should be pretty straightforward. Here is a tutorial in case you don't know how to start : http://writequit.org/blog/?p=165

  • I did not succeeded with unpacking my file according instructions in this tutorial, however, I've collected bunch of tools that will unpack almost any upx packed executable. – see ya Feb 23 '15 at 11:52
  • 1
    You should really try to unpack UPX manually at least once to understand what's going on before using tools. Otherwise you'll be stuck when you hit a slightly custom packer or if there is a bug in your tool. – Dillinur Feb 23 '15 at 13:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.