Linked Questions

0
votes
2answers
2k views

How to unpack and decrypt malware? [duplicate]

Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
0
votes
0answers
2k views

IDA sp analysis failed [duplicate]

I am trying to reverse engineer a DLL file, but I am getting this warning when it's loaded: As well, then on some of the functions error appears sp analysis failed like on this picture: Is it ...
1
vote
0answers
106 views

unpack a malware manually [duplicate]

I`m working on this malware to analyze: http://www.freeuploadsite.com/do.php?id=74209 password: infected It seems it is packed but when I use "PE View" , etc tools to find the packer, their results ...
9
votes
5answers
14k views

Freely available resource hacking applications

I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
5
votes
2answers
5k views

How to unpack files packed with multiple packers?

As I am just getting started in RE, I've mostly faced files packed with a single-layer of packing , such as UPX, ASPack, etc. Unpacking these protections is fully documented online. The problem ...
5
votes
2answers
569 views

Reversing Self-Modifying Malware

recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
0
votes
1answer
373 views

Stone's PE Encrypter v2.0

Does anybody know an unpacker/decryptor that can unpack Stone's PE Encrypter v2.0? I found one but it was for a previous version, not version 2.0. IDA's universal unpacker seems to hang when trying to ...
2
votes
1answer
430 views

Strange instructions pattern (lw) in MIPS binary

I'm trying to reverse a binary and I'm having trouble understanding a pattern that keeps showing in almost half of the functions in the binary. This is how one particular function looks like: Why is ...
2
votes
1answer
390 views

Hidden code in dissasembly

I'm testing malware that built from single EXE file and it doesn't load any other DLLs. I can see that EXE is register as COM object (I don't know how EXE can be COM object...). But when I run it and ...
-3
votes
1answer
420 views

what does VA and OEP means? and How does IAT be fixed manually? [closed]

in the context of reversing a packed binary, what does VA and OEP means? and How can IAT be fixed manually?
2
votes
0answers
390 views

Anti-dumping techniques [duplicate]

After handing on some crackmes using packed codes, I am now curious about anti-dumping techniques. For the crackmes I have encoutered, my method is as follows: after the program unpacks itself, I take ...
2
votes
1answer
210 views

General unpacking of packed malware

I did a brief survey on malware unpacking and I found several theses on automated general unpacking:Eureka, PolyUnpack, omniUnpack, Malware Normalization. However, these theses are written years ago ...