Questions tagged [unpacking]

Reverting (statically or dynamically) the effect of a binary packer: recovering its original structure and code by removing compression, encryption, protections features..

Filter by
Sorted by
Tagged with
1
vote
2answers
87 views

Decrypt application protocol packet

I have several applications that interact with the network, but the data is encrypted. I set breakpoints on send ws2_32.dll and found the correct buffer in which the encrypted data was located (then I ...
1
vote
1answer
47 views

Problems with relocation when unpacking

I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly. I started with compressing my simple x64....
-1
votes
1answer
48 views

Force debug Administrator Malware

I want to analyse a malware that do not run without administrative previliges. I know it is risky but still. How can I debug it with debugger as from entry point? Because debugger could not start ...
0
votes
0answers
44 views

Specifying DLL imports within the PE?

I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them). Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their ...
0
votes
0answers
123 views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
0
votes
0answers
21 views

Create Custom Packers

I scanned many PE files. Some files are not recognized as packed although they are packed. These are most difficult to reverse. Can you suggest me any tutorial for creating such packers or to pack ...
0
votes
1answer
30 views

IDA fails to recognize the new added segment during execution and seems to think its empty?

So i dumped a PE file after it was unpacked, but the problem is it references another section in the memory map, so i dumped that section and added it to IDA just like this question : IDA Pro - Load ...
2
votes
1answer
64 views

Invalid file path error while trying to rebuild with apktool and aapt2

I am facing an error while try to repack an apk with apkool. below is the error trace. W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'. W: error: invalid file ...
0
votes
0answers
61 views

About x64dbg find command + Help to unpack a program

The find command in x64dbg(x86), (found here: https://help.x64dbg.com/en/latest/commands/searching/find.html) doesn't return anything. For example: findall 0x00524180, "E8 ????????" returns 50 ...
1
vote
0answers
125 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
0
votes
0answers
207 views

unpacking Armadillo-packed exe on Windows 10

I was trying to unpack the Armadillo-protected target from this webpage Armadillo 4.30a with Debug Blocker - manually unpacking on Windows 10. However, I got another child process spawning again after ...
3
votes
0answers
99 views

Extracting specific files from a unknown archive file format

I'm trying to extract some binary blobs from a unknown archive format. (*.pakz). I know this archive contains some .xtreme binary files that are the files I'm looking for. My goal is to extract those ...
1
vote
0answers
34 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1
vote
0answers
50 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
0
votes
0answers
68 views

ollydbg help creating a patch

am new to ollydbg unpacking and patching. i have a programme packed with themida and i use a 1.3 unpacker script which opens the programme to the ebp opens the software up fully then i pause it here. ...
1
vote
0answers
166 views

How to extract an unknown archive files? (umd “I am alive” PC)

I'm trying to extract game files which contains textures, meshes etc. I wanted to see how hard would it be to make a texture mod. I just have knowledge on editing graphics from school and youtube ...
-1
votes
1answer
117 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
0
votes
0answers
504 views

Differences between IDA Pro and Radare2

I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows. However, I know about radare2 and that it is open source,...
0
votes
1answer
191 views

How can I retrieve image files embedded/compressed in a MPL file?

There are some images hidden somewhere in a PE I have, I can't figure out how to extract them. This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from ...
0
votes
0answers
143 views

convert NPRG9x07.mbn to NPRG9x07.bin

Hello i have qualcomm based bootloader for mdm9x07 platform i want to convert to bin format but i did not find any script that does the conversion here are the mbn files : NPRG9x07.mbn2 ENPRG9x07....
0
votes
0answers
49 views

How to execute an import exe/dll from memory

i dumped a exe/dll file from the memory with OllyDumpEx, now i understand i need to fix the address or something like this to use the dll or to run the exe, so how can i do that?
1
vote
1answer
733 views

unpacking Download.img firmware for alcatel mw40

Hello i'm trying to unpack file Download.img from alcatel mw40 (based on qualcomm 9x07) firmware but it seems i can't do it with 7zip or mount the img file . someone already extracted the file which ...
1
vote
0answers
1k views

Obfuscated Config Files: EHI Files for HTTP Injector

So I have an ehi file, which is a configuration file for an Android App called HTTP Injector. Of course when I try to see it as a simple text, I just get random characters. What tool could I use to ...
1
vote
0answers
271 views

Is there any way to change the encoding of an exe file?

I have an exe file and it will browse the xml, or txt files to display this exe file. And the characters only display the exact language of that country when I switch the language of the computer to ...
0
votes
1answer
70 views

Large number of exports defined in a PE .exe file

I have a (non-malicious) PE exe that I'm analyzing, which is using the Themida/WinLicense packer and noticed that it has 479 defined exports, which seems odd for an exe. Some of the functions are ...
3
votes
1answer
209 views

custom virtual machine protection

How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
0
votes
1answer
73 views

Windows GUI app without GetMessage imported?

I am currently trying to reverse an app and I have one very stupid question I cannot figure out by myself. The app was packed using FSG 2.0 and I successfully manually unpacked it and rebuilt the IAT ...
1
vote
1answer
306 views

.fpk firmware unpacking

I am working on firmware update file prod-build-Isat2-V02.00.03-DFU.fp2. I extracted it and I've got some bin files. I analyzed these binary files with binwalk: binwalk -E RDA-533.bin The entropy of ...
2
votes
0answers
387 views

Reconstruct InnoSetup file with existing CompiledCode.bin

Is it possible to somehow re-compile/reconstruct Inno Setup file and use existing CompiledCode.bin ? I dont have the source of CompiledCode.bin and writing from scratch is not an option. Basically ...
3
votes
2answers
364 views

Manually unpacking DarkTequila, stumped. Can anyone help?

The malware is packed w/ UPX - can see 0/1 in sections. Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to ...
1
vote
2answers
1k views

Manually unpacking upx

As a first unpacking exercise, I decided to try to unpack the famous UPX (without using upx -d of course). I chose an executable I had somewhere, built from C++ code in debug mode. I packed it using ...
1
vote
1answer
1k views

How detect version of VMProtect

I have a binary with VMProtect. Some tools giving info that this is 2.x, some that 3.x. How I could check it? Thanks.
0
votes
1answer
197 views

.app file firmware unpacking

For analyzing firmware , I want to unpack the following firmware: https://www.inmarsat.com/wp-content/uploads/2015/02/Explorer_100_110_V2-11-3.zip After unzip, I've got file named "N03_A_E_D_02_11_03....
2
votes
1answer
315 views

General unpacking of packed malware

I did a brief survey on malware unpacking and I found several theses on automated general unpacking:Eureka, PolyUnpack, omniUnpack, Malware Normalization. However, these theses are written years ago ...
1
vote
2answers
3k views

Automating bypassing anti-debug checks

I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any ...
1
vote
2answers
97 views

How can a Javascript file drop .exe written in Visual Basic without network communication?

I am analyzing a malicious JS file, which is obfuscated in a way that I could not de-obfuscate. When I executed it in a virtual machine and spectated process changes, I noticed that a new executable ...
1
vote
0answers
114 views

Binary Analysis Tool (BAT) no longer maintained - alternatives? [closed]

I read on the BAT github page that BAT is no longer actively maintained. Why did the project come to an end? What alternatives are there to unpack all kinds of archives / firmwares / binary ...
1
vote
2answers
365 views

Recreating a lzma archive (non-streamed)

I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from ...
0
votes
1answer
2k views

How to unpack(carve) files from a camera firmware .bin file? [closed]

Would anyone be willing to help me with carving/extracting files from a firmware file? I've tried to extract with binwalk, but it didn't extract everything. I checked it out with ent to see if there's ...
3
votes
1answer
1k views

How to unpack Inno Setup bundles with Arc+SREP data?

I've stumbled upon Inno Setup installer with additional separate Arc archives (commonly with .bin extension) that I was unable to extract using normal methods: the installer didn't work for an ...
2
votes
1answer
1k views

Extracting compressed firmware (NRV) for analysis

I want to analyze an embedded firmware (car's ecu). My problem is, the file is compressed. The firmware comes with a description xml file, which states that it is divided into sections and that those ...
1
vote
1answer
543 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
1
vote
1answer
486 views

De-compiling a random file format to retrieve the files?

Okay. I have a .VRCA file format which I want to retrieve the data from. Where would I need to begin in order to start retrieving data from one of these files. I've read multiple posts that mention ...
1
vote
2answers
807 views

FThunks when trying to get IAT

Pretty new to RE so sorry if this is a dumb question. I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the ...
-1
votes
1answer
539 views

Unpacking UPX OSX files

I was wondering if someone could provide me an UPX unpacker, which works with unix excutable files. I've tried a bunch of already, but all of those expect .EXE's which obviously won't work for me. ...
0
votes
1answer
2k views

binwalk showing “Unix path”, how to extract the filesystem?

When I run binwalk on a abs firmware that I'm trying to unpack, the output shows several "Unix path" entries DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------...
4
votes
4answers
15k views

Finding OEP in a VMProtect v3.0 protected malware

I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...
0
votes
1answer
478 views

How can I circumvent rdtsc when used as an anti-debugger technique?

I using x86dbg and am working on unpacking a target. The unpacking stub appears to be using some anti-debugging techniques - most of which I can detour with a plugin. However, there are a lot of ...
0
votes
1answer
211 views

Pyemu - cannot use PEPyEmu() module, Python

I want to run code from Gray Hat Python book for upx_unpacker. I have downloaded PyEmu, but when I run script I got this error: AttributeError: PEPyEmu instance has no attribute 'load' My script use ...
1
vote
1answer
2k views

Binwalk could not extract the full content

Binwalk v2.1.1 on Ubuntu, and tried to research Zyxel Router firmware. First I unzipped FW, there was 3 files: 360AUG0C0.bin, 360AUG0C0.rom, AUG107.bm I used binwalk to extract content of bin file, ...