Questions tagged [unpacking]

Reverting (statically or dynamically) the effect of a binary packer: recovering its original structure and code by removing compression, encryption, protections features..

Filter by
Sorted by
Tagged with
0 votes
1 answer
74 views

X64DBG Conditional Breakpoint on Specific Opcode?

Is there any way to break on specific opcode in X64DBG? For example i want to break on start of a function which is 55 | push ebp 8BEC | mov ebp,esp can i set a breakpoint like opcode == 0x00EC8B55? ...
Behrooz Sohrabloo's user avatar
0 votes
0 answers
44 views

IDA can't load DLL, possibly packed but how?

I tried to load a DLL to reverse engineer the code inside using IDA, but it tells me this on loading: So i assume the .text resource is somewhat "packed". I then fetched a tool named "...
HeckMeck's user avatar
0 votes
0 answers
55 views

Is there a way to access the background calculation & data in a .exe coded in fortran 30+ years ago?

The company I work for has an ancient (circa 1989-1992) program coded in Fortran that is used for sizing and selecting some of our products. We are going through a modernization project with the goal ...
JMG656's user avatar
  • 1
0 votes
0 answers
252 views

How to decompile python .exe who compiled by Nuitka?

i have one file named hello.exe and compiled using nuitka by cmd : python -m nuitka --mingw64 --windows-icon-from-ico=ICON.ico --onefile --windows-company-name=NAME --windows-product-version=1.0 --...
Teswadha's user avatar
0 votes
1 answer
64 views

How to analyze changing sections before the entry point?

I am currently looking at a packed binary that modifies the .text and other sections on startup. The sections in question are empty when stored on disk (only a non-zero virtual size). Interestingly, ...
Bobface's user avatar
  • 101
0 votes
0 answers
41 views

WebAssembly Unity base64 decipher

When in game (taming.io) going to leaderboard and searching a player id lets say: 1. It renders player data retrieved from here just fine: https://account.taming.io/player?id=1 If I type this url (get ...
Ion Iascerinschi's user avatar
0 votes
1 answer
3k views

How to extract ucas and utoc io store container files in unreal engine 5

I tried to use different programs for this, such as fmodel and UnrealPakViewer, but fmodel support only utoc, so I can extract only some part of files and it does not support binka audio files. ...
Михаил Байраков's user avatar
0 votes
1 answer
215 views

Modifying a single .class file in an obfuscated JAR

i am trying to modify a jar that is partly obfuscated (and what i want to modify is in this part). I can use Recaf, it will decompile it well and I can save modifications and export program without ...
FluffyMuffin47's user avatar
2 votes
2 answers
2k views

UPX Unpacking tool

Firstly, thank you for your answer. What is the best unpacking tool to use to unpack - UPX 0.89.6 - 1.02 / 1.05 - 1.24 ->[Overlay] could you please provide a link so i can obtain as such. Thank ...
Alan's user avatar
  • 21
0 votes
0 answers
66 views

how can i rip zuma's revenge sprites from the nintendo ds rom?

opening the bin file as a tile in tinke gives me the following: there are just random pixels that don't contain any useful sprites and it's the same if i open the file in gimp my directory for the ...
Stefan-Alexandru Kocsis's user avatar
3 votes
0 answers
75 views

How to unpack emotet with x64dbg and do dynamic analysis?

I am a beginner at malware analysis. I have been trying to analyze Emotet using X64DBG. I followed the steps below and succeeded once, but when I repeated the same steps, I failed. Can you tell me if ...
KOT's user avatar
  • 31
2 votes
0 answers
95 views

Need help extracting AP_Pack .obb files

I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb. Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
Maneki's user avatar
  • 21
4 votes
1 answer
3k views

Reverse engineering a flutter built apk

I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
hanan's user avatar
  • 309
2 votes
0 answers
49 views

WinDbg Preview search is not returning results

I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
Jason Crosby's user avatar
2 votes
0 answers
446 views

Extract assets images from a games APK [closed]

I'm trying to remove some images from an android game, but when I try to view them in a hexadecimal viewer I see that they don't contain a PNG header, so I can't view them through the python PIL ...
amateur's user avatar
  • 21
5 votes
1 answer
690 views

How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?

I have a .NET executable that is started using the process-hollowing technique. Here's how it looks from the Detect-It-Easy tool: I can open the image file for that process (from disk) with dnSpyEx, ...
c00000fd's user avatar
  • 1,659
3 votes
1 answer
2k views

How do I reverse an exe packed with an unknown packer?

I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used... How can I unpack it if it's possible? ...
beytrod's user avatar
  • 33
1 vote
1 answer
527 views

unpack ZXIC chip firmware

Is it possible to unpack this firmware for ZXIC chipset device? I tried to unpack it with binwalk but wasn't successful and I saw this information: DECIMAL HEXADECIMAL DESCRIPTION -----------...
0xnewbie's user avatar
2 votes
1 answer
516 views

Trying to learn more about unpacking

I am working on getting better with concepts of unpacking manually to get more clarity on understanding packing routines and decryption logic, so I am trying a few tutorials on PESpin! Previously I ...
ElementalX's user avatar
1 vote
0 answers
90 views

How exactly Hex editor is used?

I'm new to reverse engineering. So I decided to start with some game files in my computer. The main goal was to understand how hex editor used to identify files and extract needed data. In my case I ...
Namlind's user avatar
  • 11
3 votes
1 answer
1k views

VMProtect Anti-debugging method (without WiNAPI)

First, sorry for my bad english. I'm trying to make VMProtect unpacker with unicorn emulator, but one of my sample shows me like this anti-debugging message: WTSSendMessageW: "A debugger has been ...
schnabel's user avatar
2 votes
1 answer
754 views

How to print disassembly code with IDAPython when IDA doesn’t detect it as code

I have a piece of malware for windows / x64 which is packed, so IDA only recognizes the unpacker routine as data. This is the aspect of the zone just after loading the binary in IDA: I want to print ...
Chirrin Dul's user avatar
2 votes
1 answer
322 views

help me to debug file packed with molebox and proteced with obsidium

I have a exe file that packed with molebox and protected with obsidium. I try to unpack it with demoleition but it has some problem. when I want to open the unpacked file it says "Component '...
mamad's user avatar
  • 31
2 votes
2 answers
3k views

How to debug / analyze a Themida protected binary

Background: I have an application that has worked fine up until Windows 10 build 1511 but broke as of build 1607. It produces an access violation: STACK_TEXT: 03799f54 00f91cfa 24d1ae78 0000000f ...
Remko's user avatar
  • 3,228
0 votes
0 answers
427 views

Reconstructing "relative" import functions in IDA

Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed. I'm reverse engineering a packed win32 executable, so I ...
Steven Kyle's user avatar
1 vote
1 answer
1k views

What is unpack? how to become professional Unpacker?

I asked a lot of questions in this forum about RE and I am a beginner who is very interested in reverse engineering. (i am learning the RE with Lena151) What is unpack? Which tools need to unpack a ...
Jason's user avatar
  • 89
0 votes
0 answers
81 views

Only some files are unpacked while firmware reversing with binwalk tool

I am reversing a firmware with binwalk. Unpacking was succeed, but I can't find my target files. (CGI files in www folder) When I connect to the web page of my router, I can see links include CGI ...
Rabbit's user avatar
  • 36
2 votes
0 answers
176 views

How to modify checksum after making changes in Nokia 215 4G firmware?

If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function. ...
Mohamed's user avatar
  • 21
1 vote
1 answer
399 views

Unpacking NSISbi compressed data

I'm trying to figure out how to unpack the payload data made by NSISbi for of NSIS that adds support for installer size > 2GB. Here is an example installer: https://download.unity3d.com/...
KreonZZ's user avatar
  • 131
2 votes
1 answer
1k views

Reverse engineering a .byte file format

I've dug into files of a game that was made in Unity (which uses C# language)... and i was interested in extracting 3D models and textures etc. I understand that data and obb are separate, BUT! In my ...
user35770's user avatar
3 votes
1 answer
2k views

Rebuild IAT after manually unpacking DLL

I've been trying to unpack this dll and I'm pretty sure that 0x7c3ea902 or 0x1007A9D2 (ASLR disabled) or simply 0x7A9D2 is OEP. But after dumping with OllyDumpEx and trying to fix IAT with ImpREC it ...
majidarif's user avatar
  • 235
0 votes
0 answers
286 views

How to dump heap from packed program (unpack asprotect)

I have a packed program. I have found the oep of the program but the problem is every call to the system dll like kernel32, user32, ... change to a call to the heap. So the packer first allocate a big ...
haxerl's user avatar
  • 176
1 vote
1 answer
216 views

How to keep symbols when taking memory snapshot with IDA?

When i take memory snapshot with IDA to try to analyze it statically later, the problem is there are a lot of symbols that get lost when i dump the memory, how can i solve this? for example this is ...
Notoriouss's user avatar
0 votes
2 answers
302 views

Question about unpacking

thank for reading, i'm a beginner trying to learn Malware Analysis and Reverse Engineering, at the moment I readed the book "Learning Malware Analysis", I fully understand it, but there is ...
Fitz's user avatar
  • 1
0 votes
1 answer
1k views

can't extract a lzma compressed file

hello i want to do the reverse engineering. for tp linkTD-W8961ND_V3 firmware here is the output DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------...
soyalk's user avatar
  • 1
0 votes
0 answers
767 views

Binwalk on flash dump yielding useless files and empty file systems

I have been investigating some routers by desoldering their nand flash and dumping them using a flash programmer. However when I use binwalk on these dumps I end up with fragments of files mixed in ...
Plasma_000's user avatar
1 vote
0 answers
184 views

Unpacking or split .BIN firmware for router device

Sorry for my question, i'm newbie! so i'm trying to split or unpack this file mobile_update.bin, it is an firmware for routeur device. (Based on qualcomm 9x07 and secureboot device also), i'm trying ...
0xnewbie's user avatar
0 votes
0 answers
92 views

What kind of integer obfuscation is this?

I'm looking at the network traffic of a game submitting the user's score to the high-score server. The score value seems to be obfuscated in some way. The score is a non-negative integer, and not more ...
igk's user avatar
  • 1
3 votes
1 answer
585 views

Reconstructing a PE from unpacked memory in IDA

I’m trying to byte patch a 12 year old program written in MS Visual C++ V9. However, some of its code has been packed with ‘Lock Express V2.0’. I’ve loaded the executable in IDA and run the Universal ...
stackoverflowperson's user avatar
1 vote
2 answers
808 views

Decrypt application protocol packet

I have several applications that interact with the network, but the data is encrypted. I set breakpoints on send ws2_32.dll and found the correct buffer in which the encrypted data was located (then I ...
Polar Bear's user avatar
1 vote
3 answers
1k views

Problems with relocation when unpacking

I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly. I started with compressing my simple x64....
Zeller33's user avatar
-1 votes
1 answer
136 views

Force debug Administrator Malware

I want to analyse a malware that do not run without administrative previliges. I know it is risky but still. How can I debug it with debugger as from entry point? Because debugger could not start ...
Parampreet Rai's user avatar
0 votes
0 answers
78 views

Specifying DLL imports within the PE?

I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them). Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their ...
rob-DEV's user avatar
  • 19
4 votes
0 answers
10k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
Jimmy Hankey's user avatar
0 votes
1 answer
642 views

IDA fails to recognize the new added segment during execution and seems to think its empty?

So i dumped a PE file after it was unpacked, but the problem is it references another section in the memory map, so i dumped that section and added it to IDA just like this question : IDA Pro - Load ...
Notoriouss's user avatar
2 votes
1 answer
560 views

Invalid file path error while trying to rebuild with apktool and aapt2

I am facing an error while try to repack an apk with apkool. below is the error trace. W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'. W: error: invalid file ...
hanan's user avatar
  • 309
2 votes
0 answers
625 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
Alexandria's user avatar
3 votes
0 answers
1k views

Extracting specific files from a unknown archive file format

I'm trying to extract some binary blobs from a unknown archive format. (*.pakz). I know this archive contains some .xtreme binary files that are the files I'm looking for. My goal is to extract those ...
Felipe Lira's user avatar
1 vote
0 answers
352 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
OneAndOnly's user avatar
1 vote
0 answers
293 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
OneAndOnly's user avatar