Questions tagged [unpacking]

Reverting (statically or dynamically) the effect of a binary packer: recovering its original structure and code by removing compression, encryption, protections features..

Filter by
Sorted by
Tagged with
2
votes
2answers
740 views

Packed PE file and weird Header

I'm new to reverse engineering, so I don't know if my question will be easy or not. Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings : 000003d0: 0055 5058 ...
0
votes
2answers
519 views

Manual unpacking petya ransom [closed]

I want to manually unpack red Petya ransomware. I used Ollydbg for unpacking and set breakpoint on VirtualAlloc to see the "MZ" header in memory dump, and saved it to a file. But the saved file is not ...
1
vote
0answers
240 views

cwa file conversion

Problem description: Axivity (axivity.com/userguides/ax3/using/) watch device logs data internally in a binary packed format. This format is named Continuous Wave Accelerometer (CWA) format. This ...
0
votes
1answer
168 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
1
vote
1answer
883 views

Dose PE Explorer unpack upx executables?

I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe ...
8
votes
2answers
949 views

Automated Static Unpacking Binaries

I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
0
votes
1answer
709 views

I'd like to ask about unpacking aspack 2.12

I've tried to unpack program packed with aspack 2.12 manually by ollydbg,by setting breakpoint at RETN 0c. However whenever I tried to dump with ollydump, it sends error message like "unable to read ...
0
votes
1answer
324 views

Newbie unpacking diffculties

I'm trying to unpack a small application I compiled with VS2015 (v140_xp) and packed with UPX 3.93 (option -1). The application checks for IsDebuggerPresent and uses std::cout, nothing fancy. The ...
1
vote
1answer
1k views

How to run and reconstruct a packed DLL in IDA Pro?

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
4
votes
2answers
1k views

Why to dump precisely at OEP while manual unpacking?

What is the exact reason for dumping a process when the Program Counter is at OEP? I haven't found a decent answer. This Link says: In order to identify the IAT structure, Import Reconstructor ...
1
vote
1answer
329 views

Unpack .apk file from a PC game (NOT Android related)

I have an old PC game called Air Strike 3D II. I wanted to extract music files but I couldn't figure out how to unpack the .apk file (NOT Android package). 7-zip can't open it. When I open the .apk ...
1
vote
0answers
106 views

How can I make these images appear normal?

I'm trying to extract some images from a PS Vita game. I've managed to get a load of .bin files with names 00000.bin, 00001.bin and so on, but the file types are not the same. Each even numbered file ...
2
votes
1answer
1k views

How to unpack kkrunchy executables?

I'm trying to figure out how to unpack kkruncy executable, sources here and binaries here, anyone knows how to do it? My main idea was testing out some little hello world exes compressed with ...
1
vote
1answer
117 views

IDA pro can not resolved section after unpacking procedure

I had a sample which was packed by a packer and I unpacked it using OllyDbg but after unpacking still IDA can not resolve the section and show most of instructions as DD. Is this sample still packed ...
3
votes
1answer
420 views

How can I determine if a piece of code is an encryption algorithm?

I am trying to reverse engineer a malware, and came across a piece of code that I suspect is an encryption/decryption procedure, however I do not know for sure. I can recognize that it extracts its ...
7
votes
1answer
2k views

Zte Reverse engineering config.bin file problem

I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider. My first discovery was that the eth Lan ports are bricked wich means I can only use ...
15
votes
2answers
2k views

Decoding an unknown image format with “DREK” signature (*.drk)

There are some unknow images, which I would like to decode to RRGGBBAA format. It was a really hard work, but at the moment I can somewhat understand, that which part of the binary is responsible for ...
3
votes
1answer
2k views

What are the steps, to extract an unknown archive file in this case?

I've never did something like this before, but I have programming experiences. There are two files: data00.big and data01.big, which I would like to extract. I've tried Dragon Unpacker, which can ...
1
vote
1answer
1k views

Unpacking ASpack Malware

I'm trying to unpack a binary packed with aspack I loadded it into ollydbg 1.0 with ollydump tool. I setup hardware breakpoint at ECX and then I step over it and it is stopping at this statement: MOV ...
1
vote
0answers
143 views

Help for unpacking software [closed]

I try to unpacking a software packed with PC guard 5 there are few month and i dont arrive manually or with script to find OEP. I readed many tutorials on it but dont worked. Can you help me please ?
1
vote
0answers
1k views

Unpacking / Decrypting .dat file [closed]

Problem I am trying to decrypt or unpack a .dat file to know its value. here is the file download here When opened in notepad the text would look like these: UOSEDALB @( ...
3
votes
1answer
943 views

UPX packing/unpacking information preservation

If I pack an executable using UPX and then unpack the executable using UPX -d, the executables are not the same. I understand techniques for unpacking executables that are packed using UPX, but I was ...
2
votes
2answers
513 views

Unpacking NSPack v 2.9 based malware to get OEP

recently i am analyzing a malware which is packed with NSPack. when i am trying to unpack it using this blog link,i landed over two instruction PUSHFD,PUSHAD in ollydbg. so i put a breakpoint on the ...
3
votes
1answer
320 views

What is contained in this transmission? (RF pool-temperature sensor base unit receiver)

Note: I've made progress over at the EE stackexchange on pulling bits out of the signal (see https://electronics.stackexchange.com/questions/145714/what-encoding-is-used-in-this-signal), but now i ...
0
votes
1answer
358 views

Exe Unpack or Process Spy - Getting process internals

I want to rewrite a application tool in C# that is written in VB6. This application does not work in windows 8/10 due to some compatibility issues. It is an old game server management tool. This ...
0
votes
1answer
631 views

open source static or dynamic malware unpacker

I am looking for static and dynamic unpacker tools. I only found PE-Explorer the only can handle UPX packer. So I am carious to know is there any open source static or dynamic unpacker?
1
vote
1answer
3k views

What's the packer/encrypter used with this file

I used PEiD & Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it. could someone help with this issue? EDIT: As @beatcracker said in comments, using ExeinfoPe ...
3
votes
0answers
1k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
-1
votes
2answers
317 views

Stopping at the original entry point in a packed file

During manual unpacking, the first task is to find to original entry point. The program jumps there after the unpacking is done. I took the bin/ls file, and checked with readelf -h that the entry ...
2
votes
1answer
531 views

Unpacking and the ESP trick

I recently heard about the esp trick: some packers push all registers on the stack, and when unpacking is done, they are restored. Placing a hardware breakpoint on esp we can stop there and get the ...
1
vote
2answers
256 views

Adding Features to a Released PC Game

I've just recently finished a C++ class at my university, and I'm curious about game-modding/reverse engineering. My ultimate goal is to add features that were missing from the latest version of a ...
0
votes
1answer
2k views

what is IAT? and how to find the end of the IAT in packed exe?

I recently started to study RE in my free time. I started to look at lena151 free tutorials and now I'm on packers/protectors. Now i reached to the part that he show how to manually find the end of ...
1
vote
1answer
484 views

How to decompress SHA1[compressed] executable

I have struggled a lot to reverse an app that is delphi executable. So I trusted PEiD to tell me the truth about the app but unfortunately I found these Nothing found[overlay]* Then I switched the ...
4
votes
2answers
4k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
6
votes
0answers
659 views

Audio file compression identification

I've been working on reversing file formats from the game of star wars episode 1: the phantom menace. I have managed to extract the audio files from the .lab file in which they were contained. I ...
4
votes
2answers
3k views

IDA Pro failed to display the program in graph mode

i am a complete beginner with IDA and I have just tried to follow a tutorial on how to unpack UPX. In the tutorial IDA looks like this: When I try to get the graphical view like in the tutorial an ...
2
votes
1answer
978 views

Does Windows 7 Pro use ASLR for win32 executable?

I unpacked a UPX packed PE binary. Both the packed and unpacked binary have fixed image base of 0x400000 (Checked by various PE tools). However, every time I run the program in OllyDbg, the image ...
0
votes
1answer
196 views

Service for unpacking custom protected exes? [closed]

Is there any free/paid service on internet to unpack custom protected exes? I am a RE but unpacking is not my expertise. Thanks
2
votes
1answer
848 views

Debugging a DOS4GW/Causeway packed program

I have a DOS program that I'm trying to reverse engineer. It uses the Causeway Extender(also known as DOS4GW) in order to load the program into 32-bit protected mode, and IDA Pro 5.0 cannot extract ...
1
vote
0answers
725 views

Extract resources from compiled “resource file”

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
1
vote
0answers
112 views

unpack a malware manually [duplicate]

I`m working on this malware to analyze: http://www.freeuploadsite.com/do.php?id=74209 password: infected It seems it is packed but when I use "PE View" , etc tools to find the packer, their results ...
4
votes
2answers
2k views

How to extract the filesystem from a I240w-A firmware

I am trying to extract this ONT I240w-A firmware and binwalk reports some LZMA compressed data (dump below) but the fact the all of them read "uncompressed size: -1 bytes" makes me suspect they are ...
2
votes
1answer
1k views

Adding exception range to IDA

I encountered a problem while trying to debug an application that raises an exception to stop the debugger. How can I add an exception range, such as (00000000 - FFFFFFFF), in IDA as in Olly ?
1
vote
1answer
291 views

Unpacking abo1.exe advanced buffer overflow challenge from www.binary-auditing.com

It seems abo1.exe advanced_buffer_overflow challenge is packed, I've tried to unpack it, but I am still beginner in unpacking.It seems it is packed manually. I've also tried OllyDump and ImortREC. ...
3
votes
1answer
4k views

Set memory breakpoing on access on a section in IDA

Is there a way to set memory breakpoint on Access on IDA in Win32 debugger... like we do in Olly from the memory window ? I tried to do that with the example "UnPackMe_NoNamePacker.d.out.exe" in 20th ...
6
votes
2answers
2k views

How are obfuscators detected?

I'm guessing that tools like PeiD detect packers by looking for signatures inside the packed binary and by measuring the entropy. Is there any other work that tries to determine if a binary is ...
3
votes
2answers
7k views

Packed PE-file, where to start?

I'm new to reverse engineering, so maybe it's an easy question but not for me). I've got .exe file which is somehow packed. When I open it with IDA, I got warning that file was packed or modified, and ...
1
vote
1answer
5k views

Unpacking Asprotect SKE 2.1

Since AsProtect is pretty dated, I was wondering if there is any tools out there that can do the unpacking for the user. If not, I guess manual is the way to go. In case of manual mode, I would love ...
1
vote
3answers
990 views

Best and smarter way to improve unpacking skills

I want to find a way to improve my unpacking skills, i am not a noob but i miss steps from simple to hard packers. I saw lot of video tutorials, the most of the time i see "click F9 x times to reach ...
3
votes
2answers
3k views

Fixing import table of unpacked DLL with ImpREC : ImpRec throws “invalid OEP!” error

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried. Modified the flag in its PE header so that windows loads the ...