Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [unpacking]

Reverting (statically or dynamically) the effect of a binary packer: recovering its original structure and code by removing compression, encryption, protections features..

0
votes
0answers
3 views

Plz decode this not good script for me ( JavaScript sample )

Please help me for decoding this script. One friend helping me work under my site sometimes but still out and not completing work, then undefined for me. Him script has been obfuscated unknown tool, i ...
1
vote
2answers
149 views

Manually unpacking upx

As a first unpacking exercise, I decided to try to unpack the famous UPX (without using upx -d of course). I chose an executable I had somewhere, built from C++ code in debug mode. I packed it using ...
1
vote
1answer
131 views

How detect version of VMProtect

I have a binary with VMProtect. Some tools giving info that this is 2.x, some that 3.x. How I could check it? Thanks.
0
votes
1answer
67 views

.app file firmware unpacking

For analyzing firmware , I want to unpack the following firmware: https://www.inmarsat.com/wp-content/uploads/2015/02/Explorer_100_110_V2-11-3.zip After unzip, I've got file named "N03_A_E_D_02_11_03....
2
votes
1answer
72 views

General unpacking of packed malware

I did a brief survey on malware unpacking and I found several theses on automated general unpacking:Eureka, PolyUnpack, omniUnpack, Malware Normalization. However, these theses are written years ago ...
0
votes
0answers
26 views

Get imei device number from backup data

My phone was stolen and I only have a backup of (Data) files of the apps [Using carbon app]. I was checking the files if I can get the imei from Microsoft Authenticator app, I found the an interesting ...
1
vote
2answers
199 views

Automating bypassing anti-debug checks

I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any ...
1
vote
2answers
60 views

How can a Javascript file drop .exe written in Visual Basic without network communication?

I am analyzing a malicious JS file, which is obfuscated in a way that I could not de-obfuscate. When I executed it in a virtual machine and spectated process changes, I noticed that a new executable ...
1
vote
0answers
65 views

Binary Analysis Tool (BAT) no longer maintained - alternatives?

I read on the BAT github page that BAT is no longer actively maintained. Why did the project come to an end? What alternatives are there to unpack all kinds of archives / firmwares / binary ...
1
vote
1answer
92 views

Recreating a lzma archive (non-streamed)

I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from ...
0
votes
1answer
339 views

How to unpack(carve) files from a camera firmware .bin file? [closed]

Would anyone be willing to help me with carving/extracting files from a firmware file? I've tried to extract with binwalk, but it didn't extract everything. I checked it out with ent to see if there's ...
2
votes
1answer
139 views

How to unpack Inno Setup bundles with Arc+SREP data?

I've stumbled upon Inno Setup installer with additional separate Arc archives (commonly with .bin extension) that I was unable to extract using normal methods: the installer didn't work for an ...
2
votes
1answer
297 views

Extracting compressed firmware (NRV) for analysis

I want to analyze an embedded firmware (car's ecu). My problem is, the file is compressed. The firmware comes with a description xml file, which states that it is divided into sections and that those ...
0
votes
0answers
40 views

Identify variable length header encoding

I have a file generated by Microsoft OneNote Online service. It contains a lot of attached binary files and I need to extract all of them. All attachments are stored inside the file in the following ...
0
votes
0answers
269 views

binwalk - Is it possible to know what extraction method was used?

I have a file that I need to find out how to decompress and be able to compress back to the same format When I used binwalk to get information from the file binwalk file returns: DECIMAL ...
1
vote
1answer
248 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
1
vote
1answer
289 views

De-compiling a random file format to retrieve the files?

Okay. I have a .VRCA file format which I want to retrieve the data from. Where would I need to begin in order to start retrieving data from one of these files. I've read multiple posts that mention ...
1
vote
2answers
133 views

FThunks when trying to get IAT

Pretty new to RE so sorry if this is a dumb question. I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the ...
-1
votes
1answer
110 views

Unpacking UPX OSX files

I was wondering if someone could provide me an UPX unpacker, which works with unix excutable files. I've tried a bunch of already, but all of those expect .EXE's which obviously won't work for me. ...
0
votes
1answer
653 views

binwalk showing “Unix path”, how to extract the filesystem?

When I run binwalk on a abs firmware that I'm trying to unpack, the output shows several "Unix path" entries DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------...
4
votes
4answers
5k views

Finding OEP in a VMProtect v3.0 protected malware

I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...
0
votes
1answer
172 views

How can I circumvent rdtsc when used as an anti-debugger technique?

I using x86dbg and am working on unpacking a target. The unpacking stub appears to be using some anti-debugging techniques - most of which I can detour with a plugin. However, there are a lot of ...
0
votes
1answer
121 views

Pyemu - cannot use PEPyEmu() module, Python

I want to run code from Gray Hat Python book for upx_unpacker. I have downloaded PyEmu, but when I run script I got this error: AttributeError: PEPyEmu instance has no attribute 'load' My script use ...
0
votes
0answers
280 views

The unpacking in x64dbg doesn't work

I unpacked a binary UPX-packed with Ollydbg without problem, I'm trying to do the same on x32dbg but It doesn't work : - I found the tail jump and put a breakpoint on it then I stop at the prolog of ...
1
vote
1answer
471 views

Binwalk could not extract the full content

Binwalk v2.1.1 on Ubuntu, and tried to research Zyxel Router firmware. First I unzipped FW, there was 3 files: 360AUG0C0.bin, 360AUG0C0.rom, AUG107.bm I used binwalk to extract content of bin file, ...
0
votes
1answer
274 views

Stone's PE Encrypter v2.0

Does anybody know an unpacker/decryptor that can unpack Stone's PE Encrypter v2.0? I found one but it was for a previous version, not version 2.0. IDA's universal unpacker seems to hang when trying to ...
3
votes
1answer
4k views

Unpacking a Themida packed x64 executable?

Before we continue I'd like you to keep in mind I'm relatively new to unpacking executables. So I have a few Recently I've been trying to unpack an executable (x64 architecture), aka find the OEP and ...
6
votes
2answers
285 views

What are some ways in which virtual machines make native static and dynamic reversing of a binary more difficult?

It is practically common knowledge in reverse engineering that trying to use a native debugger or disassembler on a "VM protected" or virtualized program is much more difficult to analyze. However, I ...
-3
votes
1answer
148 views

what does VA and OEP means? and How does IAT be fixed manually? [closed]

in the context of reversing a packed binary, what does VA and OEP means? and How can IAT be fixed manually?
2
votes
0answers
106 views

How can I fix an unpacked binary which calls out-of-bounds memory?

I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
2
votes
1answer
517 views

How to change the strings in rdata section of a executable file?

I'm a programmer and have an application (an executable file that maybe compiled from a c++ source). It has an rdata section (read-only data section) that include many (several thousand) strings of ...
4
votes
1answer
157 views

Decoding LZSS buffer lookup indices

I'm working on unpacking a camera firmware file which consists of various sections that I am able to correctly split and validate. One section within this file is additionally compressed with a form ...
3
votes
1answer
355 views

Animal Crossing: Pocket Camp .zdat File

Hello I am trying to obtain the music from the new game Animal Crossing: Pocket Camp. The music is contained in files like these: https://download-cdn-ac-pocketcamp.akamaized.net/assets/...
5
votes
2answers
423 views

Reversing Self-Modifying Malware

recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
1
vote
1answer
82 views

How can I unpack this archive file?

I recently discovered a binary container file in a GameCube video game which I cannot unpack! I asked around, and I was told that it is an archive with this exact file structure: char Signature[8]; ...
3
votes
1answer
1k views

Unpack files from executable

I have an exe application that contains three files packed in it. I know how those files were named before packing, I have around 80% of packed files and some of main executable file binary code. I've ...
2
votes
2answers
430 views

Packed PE file and weird Header

I'm new to reverse engineering, so I don't know if my question will be easy or not. Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings : 000003d0: 0055 5058 ...
0
votes
2answers
339 views

Manual unpacking petya ransom [closed]

I want to manually unpack red Petya ransomware. I used Ollydbg for unpacking and set breakpoint on VirtualAlloc to see the "MZ" header in memory dump, and saved it to a file. But the saved file is not ...
1
vote
0answers
124 views

cwa file conversion

Problem description: Axivity (axivity.com/userguides/ax3/using/) watch device logs data internally in a binary packed format. This format is named Continuous Wave Accelerometer (CWA) format. This ...
0
votes
1answer
85 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
1
vote
1answer
579 views

Dose PE Explorer unpack upx executables?

I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe ...
8
votes
1answer
728 views

Automated Static Unpacking Binaries

I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
0
votes
1answer
452 views

I'd like to ask about unpacking aspack 2.12

I've tried to unpack program packed with aspack 2.12 manually by ollydbg,by setting breakpoint at RETN 0c. However whenever I tried to dump with ollydump, it sends error message like "unable to read ...
0
votes
1answer
244 views

Newbie unpacking diffculties

I'm trying to unpack a small application I compiled with VS2015 (v140_xp) and packed with UPX 3.93 (option -1). The application checks for IsDebuggerPresent and uses std::cout, nothing fancy. The ...
1
vote
1answer
865 views

How to run and reconstruct a packed DLL in IDA Pro?

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
5
votes
2answers
1k views

Why to dump precisely at OEP while manual unpacking?

What is the exact reason for dumping a process when the Program Counter is at OEP? I haven't found a decent answer. This Link says: In order to identify the IAT structure, Import Reconstructor ...
1
vote
1answer
271 views

Unpack .apk file from a PC game (NOT Android related)

I have an old PC game called Air Strike 3D II. I wanted to extract music files but I couldn't figure out how to unpack the .apk file (NOT Android package). 7-zip can't open it. When I open the .apk ...
1
vote
0answers
86 views

How can I make these images appear normal?

I'm trying to extract some images from a PS Vita game. I've managed to get a load of .bin files with names 00000.bin, 00001.bin and so on, but the file types are not the same. Each even numbered file ...
2
votes
1answer
958 views

How to unpack kkrunchy executables?

I'm trying to figure out how to unpack kkruncy executable, sources here and binaries here, anyone knows how to do it? My main idea was testing out some little hello world exes compressed with ...
1
vote
1answer
103 views

IDA pro can not resolved section after unpacking procedure

I had a sample which was packed by a packer and I unpacked it using OllyDbg but after unpacking still IDA can not resolve the section and show most of instructions as DD. Is this sample still packed ...