Questions tagged [unpacking]

Reverting (statically or dynamically) the effect of a binary packer: recovering its original structure and code by removing compression, encryption, protections features..

Filter by
Sorted by
Tagged with
1 vote
1 answer
48 views

unpack ZXIC chip firmware

Is it possible to unpack this firmware for ZXIC chipset device? I tried to unpack it with binwalk but wasn't successful and I saw this information: DECIMAL HEXADECIMAL DESCRIPTION -----------...
2 votes
1 answer
136 views

Trying to learn more about unpacking

I am working on getting better with concepts of unpacking manually to get more clarity on understanding packing routines and decryption logic, so I am trying a few tutorials on PESpin! Previously I ...
0 votes
0 answers
62 views

How exactly Hex editor is used?

I'm new to reverse engineering. So I decided to start with some game files in my computer. The main goal was to understand how hex editor used to identify files and extract needed data. In my case I ...
3 votes
1 answer
192 views

VMProtect Anti-debugging method (without WiNAPI)

First, sorry for my bad english. I'm trying to make VMProtect unpacker with unicorn emulator, but one of my sample shows me like this anti-debugging message: WTSSendMessageW: "A debugger has been ...
1 vote
1 answer
200 views

How to print disassembly code with IDAPython when IDA doesn’t detect it as code

I have a piece of malware for windows / x64 which is packed, so IDA only recognizes the unpacker routine as data. This is the aspect of the zone just after loading the binary in IDA: I want to print ...
1 vote
1 answer
106 views

help me to debug file packed with molebox and proteced with obsidium

I have a exe file that packed with molebox and protected with obsidium. I try to unpack it with demoleition but it has some problem. when I want to open the unpacked file it says "Component '...
  • 11
0 votes
0 answers
204 views

Extracting sprites from old DOS game

I'm trying to extract the sprites from the old dos version of Street Fighter 2 The sprites are spread over a couple files (SPRITES1.SF2, SPRITES2.SF2), there is another binary file called INDEX.SF2, ...
1 vote
2 answers
922 views

How to debug / analyze a Themida protected binary

Background: I have an application that has worked fine up until Windows 10 build 1511 but broke as of build 1607. It produces an access violation: STACK_TEXT: 03799f54 00f91cfa 24d1ae78 0000000f ...
  • 3,003
0 votes
0 answers
159 views

Reconstructing "relative" import functions in IDA

Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed. I'm reverse engineering a packed win32 executable, so I ...
0 votes
1 answer
284 views

What is unpack? how to become professional Unpacker?

I asked a lot of questions in this forum about RE and I am a beginner who is very interested in reverse engineering. (i am learning the RE with Lena151) What is unpack? Which tools need to unpack a ...
  • 79
0 votes
0 answers
50 views

Only some files are unpacked while firmware reversing with binwalk tool

I am reversing a firmware with binwalk. Unpacking was succeed, but I can't find my target files. (CGI files in www folder) When I connect to the web page of my router, I can see links include CGI ...
  • 36
2 votes
0 answers
102 views

How to modify checksum after making changes in Nokia 215 4G firmware?

If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function. ...
  • 21
1 vote
1 answer
151 views

Unpacking NSISbi compressed data

I'm trying to figure out how to unpack the payload data made by NSISbi for of NSIS that adds support for installer size > 2GB. Here is an example installer: https://download.unity3d.com/...
  • 31
2 votes
1 answer
494 views

Reverse engineering a .byte file format

I've dug into files of a game that was made in Unity (which uses C# language)... and i was interested in extracting 3D models and textures etc. I understand that data and obb are separate, BUT! In my ...
3 votes
1 answer
851 views

Rebuild IAT after manually unpacking DLL

I've been trying to unpack this dll and I'm pretty sure that 0x7c3ea902 or 0x1007A9D2 (ASLR disabled) or simply 0x7A9D2 is OEP. But after dumping with OllyDumpEx and trying to fix IAT with ImpREC it ...
  • 215
0 votes
0 answers
148 views

How to dump heap from packed program (unpack asprotect)

I have a packed program. I have found the oep of the program but the problem is every call to the system dll like kernel32, user32, ... change to a call to the heap. So the packer first allocate a big ...
  • 166
1 vote
1 answer
103 views

How to keep symbols when taking memory snapshot with IDA?

When i take memory snapshot with IDA to try to analyze it statically later, the problem is there are a lot of symbols that get lost when i dump the memory, how can i solve this? for example this is ...
0 votes
2 answers
217 views

Question about unpacking

thank for reading, i'm a beginner trying to learn Malware Analysis and Reverse Engineering, at the moment I readed the book "Learning Malware Analysis", I fully understand it, but there is ...
  • 1
0 votes
1 answer
468 views

can't extract a lzma compressed file

hello i want to do the reverse engineering. for tp linkTD-W8961ND_V3 firmware here is the output DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------...
  • 1
0 votes
0 answers
449 views

Binwalk on flash dump yielding useless files and empty file systems

I have been investigating some routers by desoldering their nand flash and dumping them using a flash programmer. However when I use binwalk on these dumps I end up with fragments of files mixed in ...
1 vote
0 answers
112 views

Unpacking or split .BIN firmware for router device

Sorry for my question, i'm newbie! so i'm trying to split or unpack this file mobile_update.bin, it is an firmware for routeur device. (Based on qualcomm 9x07 and secureboot device also), i'm trying ...
0 votes
0 answers
86 views

What kind of integer obfuscation is this?

I'm looking at the network traffic of a game submitting the user's score to the high-score server. The score value seems to be obfuscated in some way. The score is a non-negative integer, and not more ...
  • 1
3 votes
1 answer
260 views

Reconstructing a PE from unpacked memory in IDA

I’m trying to byte patch a 12 year old program written in MS Visual C++ V9. However, some of its code has been packed with ‘Lock Express V2.0’. I’ve loaded the executable in IDA and run the Universal ...
1 vote
2 answers
512 views

Decrypt application protocol packet

I have several applications that interact with the network, but the data is encrypted. I set breakpoints on send ws2_32.dll and found the correct buffer in which the encrypted data was located (then I ...
1 vote
3 answers
683 views

Problems with relocation when unpacking

I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly. I started with compressing my simple x64....
-1 votes
1 answer
104 views

Force debug Administrator Malware

I want to analyse a malware that do not run without administrative previliges. I know it is risky but still. How can I debug it with debugger as from entry point? Because debugger could not start ...
0 votes
0 answers
56 views

Specifying DLL imports within the PE?

I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them). Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their ...
  • 19
2 votes
0 answers
8k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
0 votes
1 answer
282 views

IDA fails to recognize the new added segment during execution and seems to think its empty?

So i dumped a PE file after it was unpacked, but the problem is it references another section in the memory map, so i dumped that section and added it to IDA just like this question : IDA Pro - Load ...
2 votes
1 answer
320 views

Invalid file path error while trying to rebuild with apktool and aapt2

I am facing an error while try to repack an apk with apkool. below is the error trace. W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'. W: error: invalid file ...
  • 189
2 votes
0 answers
409 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
3 votes
0 answers
940 views

Extracting specific files from a unknown archive file format

I'm trying to extract some binary blobs from a unknown archive format. (*.pakz). I know this archive contains some .xtreme binary files that are the files I'm looking for. My goal is to extract those ...
1 vote
0 answers
165 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1 vote
0 answers
195 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
1 vote
0 answers
471 views

How to extract an unknown archive files? (umd "I am alive" PC)

I'm trying to extract game files which contains textures, meshes etc. I wanted to see how hard would it be to make a texture mod. I just have knowledge on editing graphics from school and youtube ...
  • 11
-1 votes
1 answer
175 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
  • 1
0 votes
1 answer
375 views

How can I retrieve image files embedded/compressed in a MPL file?

There are some images hidden somewhere in a PE I have, I can't figure out how to extract them. This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from ...
-1 votes
1 answer
546 views

convert NPRG9x07.mbn to NPRG9x07.bin

Hello i have qualcomm based bootloader for mdm9x07 platform i want to convert to bin format but i did not find any script that does the conversion here are the mbn files : NPRG9x07.mbn2 ENPRG9x07....
  • 101
0 votes
0 answers
65 views

How to execute an import exe/dll from memory

i dumped a exe/dll file from the memory with OllyDumpEx, now i understand i need to fix the address or something like this to use the dll or to run the exe, so how can i do that?
  • 11
2 votes
1 answer
2k views

unpacking Download.img firmware for alcatel mw40

Hello i'm trying to unpack file Download.img from alcatel mw40 (based on qualcomm 9x07) firmware but it seems i can't do it with 7zip or mount the img file . someone already extracted the file which ...
  • 101
1 vote
0 answers
2k views

Obfuscated Config Files: EHI Files for HTTP Injector

So I have an ehi file, which is a configuration file for an Android App called HTTP Injector. Of course when I try to see it as a simple text, I just get random characters. What tool could I use to ...
  • 11
1 vote
0 answers
603 views

Is there any way to change the encoding of an exe file?

I have an exe file and it will browse the xml, or txt files to display this exe file. And the characters only display the exact language of that country when I switch the language of the computer to ...
0 votes
1 answer
89 views

Large number of exports defined in a PE .exe file

I have a (non-malicious) PE exe that I'm analyzing, which is using the Themida/WinLicense packer and noticed that it has 479 defined exports, which seems odd for an exe. Some of the functions are ...
  • 25
3 votes
1 answer
419 views

custom virtual machine protection

How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
  • 163
0 votes
1 answer
81 views

Windows GUI app without GetMessage imported?

I am currently trying to reverse an app and I have one very stupid question I cannot figure out by myself. The app was packed using FSG 2.0 and I successfully manually unpacked it and rebuilt the IAT ...
  • 1
2 votes
1 answer
425 views

.fpk firmware unpacking

I am working on firmware update file prod-build-Isat2-V02.00.03-DFU.fp2. I extracted it and I've got some bin files. I analyzed these binary files with binwalk: binwalk -E RDA-533.bin The entropy of ...
  • 21
2 votes
0 answers
867 views

Reconstruct InnoSetup file with existing CompiledCode.bin

Is it possible to somehow re-compile/reconstruct Inno Setup file and use existing CompiledCode.bin ? I dont have the source of CompiledCode.bin and writing from scratch is not an option. Basically ...
  • 121
3 votes
2 answers
584 views

Manually unpacking DarkTequila, stumped. Can anyone help?

The malware is packed w/ UPX - can see 0/1 in sections. Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to ...
3 votes
2 answers
3k views

Manually unpacking upx

As a first unpacking exercise, I decided to try to unpack the famous UPX (without using upx -d of course). I chose an executable I had somewhere, built from C++ code in debug mode. I packed it using ...
  • 187
1 vote
1 answer
2k views

How detect version of VMProtect

I have a binary with VMProtect. Some tools giving info that this is 2.x, some that 3.x. How I could check it? Thanks.