I want to implement a generic, static unpacker that can statically unpack files that have been packed with unknown packers. In fact, I want it to be able to unpack packers which I just think of.

Thanks a lot for your help.


You can't. You don't know how the file is packed, the only thing you have is the unpacking code in the file. You could try running the file through an emulator like QEMU, so the unpacking takes place in the emulator, not in the "physical" computer. However, that still executes the code.

And you'll have the problem that you don't know when you reach the end of the unpacker start the original program - there's no way to tell unless you have several different executables which are packed with an identical packer and check where they start behaving differently. (And even then, they might be encrypted with different keys, so your programs will behave differently when they retrieve the key).

You can't even know if the unpacker unpacks everything at once, or only the main program, and unpacks the rest of the program on the fly when it's being used.

Believe me, many people would already have implemented this if it was possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.