Questions tagged [unpacking]

Reverting (statically or dynamically) the effect of a binary packer: recovering its original structure and code by removing compression, encryption, protections features..

Filter by
Sorted by
Tagged with
2
votes
1answer
1k views

Does Windows 7 Pro use ASLR for win32 executable?

I unpacked a UPX packed PE binary. Both the packed and unpacked binary have fixed image base of 0x400000 (Checked by various PE tools). However, every time I run the program in OllyDbg, the image ...
0
votes
1answer
2k views

How to run and reconstruct a packed DLL in IDA Pro?

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
1
vote
0answers
866 views

Extract resources from compiled "resource file"

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
4
votes
2answers
2k views

Why to dump precisely at OEP while manual unpacking?

What is the exact reason for dumping a process when the Program Counter is at OEP? I haven't found a decent answer. This Link says: In order to identify the IAT structure, Import Reconstructor ...
1
vote
0answers
116 views

How can I make these images appear normal?

I'm trying to extract some images from a PS Vita game. I've managed to get a load of .bin files with names 00000.bin, 00001.bin and so on, but the file types are not the same. Each even numbered file ...
1
vote
1answer
137 views

IDA pro can not resolved section after unpacking procedure

I had a sample which was packed by a packer and I unpacked it using OllyDbg but after unpacking still IDA can not resolve the section and show most of instructions as DD. Is this sample still packed ...
3
votes
1answer
367 views

What is contained in this transmission? (RF pool-temperature sensor base unit receiver)

Note: I've made progress over at the EE stackexchange on pulling bits out of the signal (see https://electronics.stackexchange.com/questions/145714/what-encoding-is-used-in-this-signal), but now i ...
2
votes
1answer
2k views

How to unpack kkrunchy executables?

I'm trying to figure out how to unpack kkruncy executable, sources here and binaries here, anyone knows how to do it? My main idea was testing out some little hello world exes compressed with ...
41
votes
3answers
25k views

Unpacking binaries in a generic way

I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy ...
0
votes
1answer
392 views

Why is IAT filled with static addresses instead of function names?

When a program is packed the OriginalFirstThunk tends to be discarded. When the loader resolves the imports, then how does it know which functions to look for? For some reason the IAT (FirstThunk) is ...
3
votes
2answers
5k views

Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried. Modified the flag in its PE header so that windows loads the ...
11
votes
1answer
1k views

What is import reconstruction and why is it necessary?

When reading about unpacking, I sometimes see an "import reconstruction" step. What is this and why is it necessary?
1
vote
2answers
472 views

Why isn't the import table ready at OEP?

When manually unpacking a program and ending up at the OEP, then why do we have to rebuild the import table? I understand that when packing, the import table is destroyed for compression/stealth, but ...
2
votes
0answers
2k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
3
votes
1answer
2k views

What are the steps, to extract an unknown archive file in this case?

I've never did something like this before, but I have programming experiences. There are two files: data00.big and data01.big, which I would like to extract. I've tried Dragon Unpacker, which can ...
17
votes
4answers
4k views

How can you reliably unpack a Windows driver manually?

When you unpack manually a Windows user-mode executable, you can easily break at its EntryPoint (or TLS), then trace until you reach the original EntryPoint. However that's not possible with a packed ...
1
vote
0answers
186 views

Help for unpacking software [closed]

I try to unpacking a software packed with PC guard 5 there are few month and i dont arrive manually or with script to find OEP. I readed many tutorials on it but dont worked. Can you help me please ?
4
votes
2answers
5k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
1
vote
0answers
2k views

Unpacking / Decrypting .dat file [closed]

Problem I am trying to decrypt or unpack a .dat file to know its value. here is the file download here When opened in notepad the text would look like these: UOSEDALB @( ...
4
votes
1answer
2k views

UPX packing/unpacking information preservation

If I pack an executable using UPX and then unpack the executable using UPX -d, the executables are not the same. I understand techniques for unpacking executables that are packed using UPX, but I was ...
2
votes
2answers
632 views

Unpacking NSPack v 2.9 based malware to get OEP

recently i am analyzing a malware which is packed with NSPack. when i am trying to unpack it using this blog link,i landed over two instruction PUSHFD,PUSHAD in ollydbg. so i put a breakpoint on the ...
-1
votes
2answers
521 views

Stopping at the original entry point in a packed file

During manual unpacking, the first task is to find to original entry point. The program jumps there after the unpacking is done. I took the bin/ls file, and checked with readelf -h that the entry ...
0
votes
1answer
530 views

Exe Unpack or Process Spy - Getting process internals

I want to rewrite a application tool in C# that is written in VB6. This application does not work in windows 8/10 due to some compatibility issues. It is an old game server management tool. This ...
0
votes
1answer
703 views

open source static or dynamic malware unpacker

I am looking for static and dynamic unpacker tools. I only found PE-Explorer the only can handle UPX packer. So I am carious to know is there any open source static or dynamic unpacker?
2
votes
1answer
4k views

What's the packer/encrypter used with this file

I used PEiD & Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it. could someone help with this issue? EDIT: As @beatcracker said in comments, using ExeinfoPe ...
2
votes
1answer
682 views

Unpacking and the ESP trick

I recently heard about the esp trick: some packers push all registers on the stack, and when unpacking is done, they are restored. Placing a hardware breakpoint on esp we can stop there and get the ...
1
vote
2answers
305 views

Adding Features to a Released PC Game

I've just recently finished a C++ class at my university, and I'm curious about game-modding/reverse engineering. My ultimate goal is to add features that were missing from the latest version of a ...
0
votes
4answers
3k views

Where to find a hard crackme [closed]

I'd like to improve my skill as a reverse engineer. And thus I am looking for a location to find these.
0
votes
1answer
3k views

what is IAT? and how to find the end of the IAT in packed exe?

I recently started to study RE in my free time. I started to look at lena151 free tutorials and now I'm on packers/protectors. Now i reached to the part that he show how to manually find the end of ...
6
votes
0answers
821 views

Audio file compression identification

I've been working on reversing file formats from the game of star wars episode 1: the phantom menace. I have managed to extract the audio files from the .lab file in which they were contained. I ...
1
vote
1answer
568 views

How to decompress SHA1[compressed] executable

I have struggled a lot to reverse an app that is delphi executable. So I trusted PEiD to tell me the truth about the app but unfortunately I found these Nothing found[overlay]* Then I switched the ...
0
votes
1answer
212 views

Service for unpacking custom protected exes? [closed]

Is there any free/paid service on internet to unpack custom protected exes? I am a RE but unpacking is not my expertise. Thanks
4
votes
2answers
2k views

How to extract the filesystem from a I240w-A firmware

I am trying to extract this ONT I240w-A firmware and binwalk reports some LZMA compressed data (dump below) but the fact the all of them read "uncompressed size: -1 bytes" makes me suspect they are ...
1
vote
2answers
2k views

debug a .dll compressed with pe compact

I am trying to load a DLL in IDA and OllyDbg, but it says the file is compressed. I checked with a couple of tools and came to know that the file is compressed with PECompact. I think it also has ...
1
vote
1answer
6k views

Unpacking Asprotect SKE 2.1

Since AsProtect is pretty dated, I was wondering if there is any tools out there that can do the unpacking for the user. If not, I guess manual is the way to go. In case of manual mode, I would love ...
1
vote
0answers
113 views

unpack a malware manually [duplicate]

I`m working on this malware to analyze: http://www.freeuploadsite.com/do.php?id=74209 password: infected It seems it is packed but when I use "PE View" , etc tools to find the packer, their results ...
2
votes
1answer
1k views

Adding exception range to IDA

I encountered a problem while trying to debug an application that raises an exception to stop the debugger. How can I add an exception range, such as (00000000 - FFFFFFFF), in IDA as in Olly ?
1
vote
1answer
309 views

Unpacking abo1.exe advanced buffer overflow challenge from www.binary-auditing.com

It seems abo1.exe advanced_buffer_overflow challenge is packed, I've tried to unpack it, but I am still beginner in unpacking.It seems it is packed manually. I've also tried OllyDump and ImortREC. ...
3
votes
1answer
5k views

Set memory breakpoing on access on a section in IDA

Is there a way to set memory breakpoint on Access on IDA in Win32 debugger... like we do in Olly from the memory window ? I tried to do that with the example "UnPackMe_NoNamePacker.d.out.exe" in 20th ...
6
votes
2answers
2k views

How are obfuscators detected?

I'm guessing that tools like PeiD detect packers by looking for signatures inside the packed binary and by measuring the entropy. Is there any other work that tries to determine if a binary is ...
2
votes
2answers
9k views

Packed PE-file, where to start?

I'm new to reverse engineering, so maybe it's an easy question but not for me). I've got .exe file which is somehow packed. When I open it with IDA, I got warning that file was packed or modified, and ...
1
vote
3answers
1k views

Best and smarter way to improve unpacking skills

I want to find a way to improve my unpacking skills, i am not a noob but i miss steps from simple to hard packers. I saw lot of video tutorials, the most of the time i see "click F9 x times to reach ...
-1
votes
1answer
647 views

How can I statically unpack a file packed with an unknown packer without executing it?

I want to implement a generic, static unpacker that can statically unpack files that have been packed with unknown packers. In fact, I want it to be able to unpack packers which I just think of. ...
3
votes
1answer
2k views

What are indicators for hitting the OEP?

for me, it is sometimes difficult to decide if I have hit the OEP when I try to manuelly unpack it. Especially in cases, when it does not begin with the standard function prologue. For example: I ...
2
votes
2answers
2k views

Unpacking a backdoor program for studying

I wanted to learn something about unpacking malware manuelly and found the following link: writequit.org/blog/?p=165. As you can see, the malware in that example begins with the PUSHAD instruction....
2
votes
1answer
2k views

Non standard LZ77 compression header

I'm working on reversing the SJ4000 camera firmware but I found a problem unpacking it. This is the header I found on the image: 00000000 42 43 4c 31 81 66 00 09 00 54 68 e0 00 2f 2b bf |BCL1.f......
0
votes
1answer
69 views

How do I unpack a TBN File, meant for flashing a phone?

I have a file used to flash new firmware to a phone and I need to unpack it into smaller files that are contained in the "TBN" file. The smaller files that are contained in the TBN file are common ...
0
votes
1answer
2k views

Windows CE + Itron RTOS image

I'm working on unpacking a firmware image, I managed to uncompress the original image but I'm stuck in the current step. First of all this is the current uncompressed image: https://www.dropbox.com/s/...
2
votes
1answer
405 views

Generate Mach-O binary from running process

I have a packed executable. To take care of the unpacking, I would like to extract the in-memory version of the process, which would ideally be rolled back into the equivalent Mach-O binary -- such ...
1
vote
0answers
351 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...