Questions tagged [unpacking]

Reverting (statically or dynamically) the effect of a binary packer: recovering its original structure and code by removing compression, encryption, protections features..

39 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
0answers
815 views

Audio file compression identification

I've been working on reversing file formats from the game of star wars episode 1: the phantom menace. I have managed to extract the audio files from the .lab file in which they were contained. I ...
5
votes
2answers
667 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
4
votes
0answers
704 views

Need help figuring out compression used on a PKDPX file from a Nintendo DS game

So, I've been working on reversing several file formats from the Nintendo DS game Pokemon Mystery Dungeon: Explorers of Sky. So far most formats were pretty easy to reverse, until I stumbled on a ...
3
votes
0answers
470 views

Extracting specific files from a unknown archive file format

I'm trying to extract some binary blobs from a unknown archive format. (*.pakz). I know this archive contains some .xtreme binary files that are the files I'm looking for. My goal is to extract those ...
3
votes
0answers
2k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
2
votes
0answers
60 views

How to modify checksum after making changes in Nokia 215 4G firmware?

If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function. ...
2
votes
0answers
5k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
2
votes
0answers
623 views

Reconstruct InnoSetup file with existing CompiledCode.bin

Is it possible to somehow re-compile/reconstruct Inno Setup file and use existing CompiledCode.bin ? I dont have the source of CompiledCode.bin and writing from scratch is not an option. Basically ...
2
votes
0answers
256 views

How can I fix an unpacked binary which calls out-of-bounds memory?

I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
2
votes
0answers
1k views

Bypassing Enigma loader

Currently I'm trying to get past Enigma's loader, which asks you for a name & key, as an excercise. I have very little progress, as I haven't worked too much with packers. What I did was ...
2
votes
0answers
2k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
1
vote
0answers
55 views

Unpacking or split .BIN firmware for router device

Sorry for my question, i'm newbie! so i'm trying to split or unpack this file mobile_update.bin, it is an firmware for routeur device. (Based on qualcomm 9x07 and secureboot device also), i'm trying ...
1
vote
0answers
286 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
1
vote
0answers
96 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1
vote
0answers
134 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
1
vote
0answers
341 views

How to extract an unknown archive files? (umd “I am alive” PC)

I'm trying to extract game files which contains textures, meshes etc. I wanted to see how hard would it be to make a texture mod. I just have knowledge on editing graphics from school and youtube ...
1
vote
0answers
1k views

Obfuscated Config Files: EHI Files for HTTP Injector

So I have an ehi file, which is a configuration file for an Android App called HTTP Injector. Of course when I try to see it as a simple text, I just get random characters. What tool could I use to ...
1
vote
0answers
474 views

Is there any way to change the encoding of an exe file?

I have an exe file and it will browse the xml, or txt files to display this exe file. And the characters only display the exact language of that country when I switch the language of the computer to ...
1
vote
1answer
367 views

.fpk firmware unpacking

I am working on firmware update file prod-build-Isat2-V02.00.03-DFU.fp2. I extracted it and I've got some bin files. I analyzed these binary files with binwalk: binwalk -E RDA-533.bin The entropy of ...
1
vote
0answers
394 views

cwa file conversion

Problem description: Axivity (axivity.com/userguides/ax3/using/) watch device logs data internally in a binary packed format. This format is named Continuous Wave Accelerometer (CWA) format. This ...
1
vote
0answers
115 views

How can I make these images appear normal?

I'm trying to extract some images from a PS Vita game. I've managed to get a load of .bin files with names 00000.bin, 00001.bin and so on, but the file types are not the same. Each even numbered file ...
1
vote
0answers
864 views

Extract resources from compiled “resource file”

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
1
vote
0answers
351 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
0
votes
0answers
25 views

Unpacking firmware of TP-LINK IPC firmware

I have some TP-LINK IPC firmware that must be reversed (as a task). But I can not unpack the .bin firmware and extract the file system. Binwalk output: 576 0x240 xz compressed data ...
0
votes
0answers
34 views

Reconstructing “relative” import functions in IDA

Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed. I'm reverse engineering a packed win32 executable, so I ...
0
votes
0answers
21 views

Only some files are unpacked while firmware reversing with binwalk tool

I am reversing a firmware with binwalk. Unpacking was succeed, but I can't find my target files. (CGI files in www folder) When I connect to the web page of my router, I can see links include CGI ...
0
votes
0answers
51 views

How to restore section headers in UPX unpack?

How would I fully unpack UPX? It seems to me that unpacking it by dumping and fixing the IAT does not actually fix the section headers.
0
votes
0answers
112 views

How to dump heap from packed program (unpack asprotect)

I have a packed program. I have found the oep of the program but the problem is every call to the system dll like kernel32, user32, ... change to a call to the heap. So the packer first allocate a big ...
0
votes
0answers
46 views

Dumping a packed shared library

I have 2 packed shared libraries, the second one is probably dependent on first one. The first one is packed with UPX, and the unpacking code is in .init_proc. I have tried attaching a debugger and ...
0
votes
0answers
95 views

Unpack old DLink DIR-855 firmware

I'm trying to reverse engineer an old firmware of the D-Link DIR-855. The latest binary can be found here: ftp://ftp.dlink.de/dir/dir-855/driver_software/DIR-855_fw_reva_124eub01_ALL_multi_20130614....
0
votes
0answers
192 views

Binwalk on flash dump yielding useless files and empty file systems

I have been investigating some routers by desoldering their nand flash and dumping them using a flash programmer. However when I use binwalk on these dumps I end up with fragments of files mixed in ...
0
votes
0answers
84 views

What kind of integer obfuscation is this?

I'm looking at the network traffic of a game submitting the user's score to the high-score server. The score value seems to be obfuscated in some way. The score is a non-negative integer, and not more ...
0
votes
0answers
49 views

Specifying DLL imports within the PE?

I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them). Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their ...
0
votes
1answer
296 views

How can I retrieve image files embedded/compressed in a MPL file?

There are some images hidden somewhere in a PE I have, I can't figure out how to extract them. This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from ...
0
votes
0answers
55 views

How to execute an import exe/dll from memory

i dumped a exe/dll file from the memory with OllyDumpEx, now i understand i need to fix the address or something like this to use the dll or to run the exe, so how can i do that?
0
votes
1answer
477 views

Newbie unpacking diffculties

I'm trying to unpack a small application I compiled with VS2015 (v140_xp) and packed with UPX 3.93 (option -1). The application checks for IsDebuggerPresent and uses std::cout, nothing fancy. The ...
-1
votes
1answer
133 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
-1
votes
1answer
325 views

convert NPRG9x07.mbn to NPRG9x07.bin

Hello i have qualcomm based bootloader for mdm9x07 platform i want to convert to bin format but i did not find any script that does the conversion here are the mbn files : NPRG9x07.mbn2 ENPRG9x07....
-1
votes
2answers
503 views

Stopping at the original entry point in a packed file

During manual unpacking, the first task is to find to original entry point. The program jumps there after the unpacking is done. I took the bin/ls file, and checked with readelf -h that the entry ...