2

I was playing around with tutorials/white papers concerning unpacking, specifically UPX. As Olly 2.01 is my debugger of choice, I attempted to unpack an UPX-packed exe with it and to my surprise, it looks as though it fails to break where it should.

With Olly 1.10, the execution will stop twice:

1) First in ntdll enter image description here

2) Then the well known PUSHAD instruction in the actual module: enter image description here

The JMP visible above will jump to the unpacked code: enter image description here


This is the kind of behavior I'd expect. However, Olly 2.01 with the same settings (break at "Entry point of main module") will stop at this jump instead: enter image description here

Which, if followed, will immediately bring us to the unpacked code: enter image description here

Additionally, the bytes preceding the JMP in both cases seem to differ, as do the addresses, suggesting this is actually a different piece of code.


What is happening? Is Olly 2.01 actually "smarter", recognizing the packer and stopping at the unpacked OEP? Also, why are the JMPs to unpacked code different (as stated above, different instructions before them and different addresses)?

Improve this question

1 Answer 1

Reset to default
2

Is Olly 2.01 actually "smarter", recognizing the packer and stopping at the unpacked OEP?

Yes! You can disable it in OllyDbg's options though by going to Debugging → SFX and unchecking Unpack SFX modules automatically:

Self-extractable modules

Improve this answer
1
  • 1
    Wouldn't have guessed :) Goes to show how amazing this free tool is.
    – user4520
    Feb 19, 2015 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.