Questions tagged [unpacking]

Reverting (statically or dynamically) the effect of a binary packer: recovering its original structure and code by removing compression, encryption, protections features..

Filter by
Sorted by
Tagged with
0
votes
1answer
492 views

Stone's PE Encrypter v2.0

Does anybody know an unpacker/decryptor that can unpack Stone's PE Encrypter v2.0? I found one but it was for a previous version, not version 2.0. IDA's universal unpacker seems to hang when trying to ...
5
votes
1answer
12k views

Unpacking a Themida packed x64 executable?

Before we continue I'd like you to keep in mind I'm relatively new to unpacking executables. So I have a few Recently I've been trying to unpack an executable (x64 architecture), aka find the OEP and ...
5
votes
2answers
332 views

What are some ways in which virtual machines make native static and dynamic reversing of a binary more difficult?

It is practically common knowledge in reverse engineering that trying to use a native debugger or disassembler on a "VM protected" or virtualized program is much more difficult to analyze. However, I ...
-3
votes
1answer
915 views

what does VA and OEP means? and How does IAT be fixed manually? [closed]

in the context of reversing a packed binary, what does VA and OEP means? and How can IAT be fixed manually?
2
votes
0answers
232 views

How can I fix an unpacked binary which calls out-of-bounds memory?

I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
2
votes
1answer
1k views

How to change the strings in rdata section of a executable file?

I'm a programmer and have an application (an executable file that maybe compiled from a c++ source). It has an rdata section (read-only data section) that include many (several thousand) strings of ...
4
votes
1answer
343 views

Decoding LZSS buffer lookup indices

I'm working on unpacking a camera firmware file which consists of various sections that I am able to correctly split and validate. One section within this file is additionally compressed with a form ...
3
votes
1answer
511 views

Animal Crossing: Pocket Camp .zdat File

Hello I am trying to obtain the music from the new game Animal Crossing: Pocket Camp. The music is contained in files like these: https://download-cdn-ac-pocketcamp.akamaized.net/assets/...
5
votes
2answers
817 views

Reversing Self-Modifying Malware

recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
1
vote
1answer
176 views

How can I unpack this archive file?

I recently discovered a binary container file in a GameCube video game which I cannot unpack! I asked around, and I was told that it is an archive with this exact file structure: char Signature[8]; ...
4
votes
1answer
5k views

Unpack files from executable

I have an exe application that contains three files packed in it. I know how those files were named before packing, I have around 80% of packed files and some of main executable file binary code. I've ...
2
votes
2answers
897 views

Packed PE file and weird Header

I'm new to reverse engineering, so I don't know if my question will be easy or not. Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings : 000003d0: 0055 5058 ...
0
votes
2answers
554 views

Manual unpacking petya ransom [closed]

I want to manually unpack red Petya ransomware. I used Ollydbg for unpacking and set breakpoint on VirtualAlloc to see the "MZ" header in memory dump, and saved it to a file. But the saved file is not ...
1
vote
0answers
306 views

cwa file conversion

Problem description: Axivity (axivity.com/userguides/ax3/using/) watch device logs data internally in a binary packed format. This format is named Continuous Wave Accelerometer (CWA) format. This ...
0
votes
1answer
210 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
1
vote
1answer
1k views

Dose PE Explorer unpack upx executables?

I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe ...
8
votes
2answers
991 views

Automated Static Unpacking Binaries

I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
0
votes
1answer
830 views

I'd like to ask about unpacking aspack 2.12

I've tried to unpack program packed with aspack 2.12 manually by ollydbg,by setting breakpoint at RETN 0c. However whenever I tried to dump with ollydump, it sends error message like "unable to read ...
0
votes
1answer
362 views

Newbie unpacking diffculties

I'm trying to unpack a small application I compiled with VS2015 (v140_xp) and packed with UPX 3.93 (option -1). The application checks for IsDebuggerPresent and uses std::cout, nothing fancy. The ...
0
votes
1answer
2k views

How to run and reconstruct a packed DLL in IDA Pro?

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
4
votes
2answers
2k views

Why to dump precisely at OEP while manual unpacking?

What is the exact reason for dumping a process when the Program Counter is at OEP? I haven't found a decent answer. This Link says: In order to identify the IAT structure, Import Reconstructor ...
1
vote
1answer
363 views

Unpack .apk file from a PC game (NOT Android related)

I have an old PC game called Air Strike 3D II. I wanted to extract music files but I couldn't figure out how to unpack the .apk file (NOT Android package). 7-zip can't open it. When I open the .apk ...
1
vote
0answers
115 views

How can I make these images appear normal?

I'm trying to extract some images from a PS Vita game. I've managed to get a load of .bin files with names 00000.bin, 00001.bin and so on, but the file types are not the same. Each even numbered file ...
2
votes
1answer
2k views

How to unpack kkrunchy executables?

I'm trying to figure out how to unpack kkruncy executable, sources here and binaries here, anyone knows how to do it? My main idea was testing out some little hello world exes compressed with ...
1
vote
1answer
122 views

IDA pro can not resolved section after unpacking procedure

I had a sample which was packed by a packer and I unpacked it using OllyDbg but after unpacking still IDA can not resolve the section and show most of instructions as DD. Is this sample still packed ...
3
votes
1answer
441 views

How can I determine if a piece of code is an encryption algorithm?

I am trying to reverse engineer a malware, and came across a piece of code that I suspect is an encryption/decryption procedure, however I do not know for sure. I can recognize that it extracts its ...
7
votes
1answer
3k views

Zte Reverse engineering config.bin file problem

I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider. My first discovery was that the eth Lan ports are bricked wich means I can only use ...
16
votes
2answers
2k views

Decoding an unknown image format with “DREK” signature (*.drk)

There are some unknow images, which I would like to decode to RRGGBBAA format. It was a really hard work, but at the moment I can somewhat understand, that which part of the binary is responsible for ...
3
votes
1answer
2k views

What are the steps, to extract an unknown archive file in this case?

I've never did something like this before, but I have programming experiences. There are two files: data00.big and data01.big, which I would like to extract. I've tried Dragon Unpacker, which can ...
1
vote
1answer
1k views

Unpacking ASpack Malware

I'm trying to unpack a binary packed with aspack I loadded it into ollydbg 1.0 with ollydump tool. I setup hardware breakpoint at ECX and then I step over it and it is stopping at this statement: MOV ...
1
vote
0answers
163 views

Help for unpacking software [closed]

I try to unpacking a software packed with PC guard 5 there are few month and i dont arrive manually or with script to find OEP. I readed many tutorials on it but dont worked. Can you help me please ?
1
vote
0answers
2k views

Unpacking / Decrypting .dat file [closed]

Problem I am trying to decrypt or unpack a .dat file to know its value. here is the file download here When opened in notepad the text would look like these: UOSEDALB @( ...
3
votes
1answer
1k views

UPX packing/unpacking information preservation

If I pack an executable using UPX and then unpack the executable using UPX -d, the executables are not the same. I understand techniques for unpacking executables that are packed using UPX, but I was ...
2
votes
2answers
553 views

Unpacking NSPack v 2.9 based malware to get OEP

recently i am analyzing a malware which is packed with NSPack. when i am trying to unpack it using this blog link,i landed over two instruction PUSHFD,PUSHAD in ollydbg. so i put a breakpoint on the ...
3
votes
1answer
330 views

What is contained in this transmission? (RF pool-temperature sensor base unit receiver)

Note: I've made progress over at the EE stackexchange on pulling bits out of the signal (see https://electronics.stackexchange.com/questions/145714/what-encoding-is-used-in-this-signal), but now i ...
0
votes
1answer
417 views

Exe Unpack or Process Spy - Getting process internals

I want to rewrite a application tool in C# that is written in VB6. This application does not work in windows 8/10 due to some compatibility issues. It is an old game server management tool. This ...
0
votes
1answer
653 views

open source static or dynamic malware unpacker

I am looking for static and dynamic unpacker tools. I only found PE-Explorer the only can handle UPX packer. So I am carious to know is there any open source static or dynamic unpacker?
2
votes
1answer
3k views

What's the packer/encrypter used with this file

I used PEiD & Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it. could someone help with this issue? EDIT: As @beatcracker said in comments, using ExeinfoPe ...
3
votes
0answers
1k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
-1
votes
2answers
384 views

Stopping at the original entry point in a packed file

During manual unpacking, the first task is to find to original entry point. The program jumps there after the unpacking is done. I took the bin/ls file, and checked with readelf -h that the entry ...
2
votes
1answer
615 views

Unpacking and the ESP trick

I recently heard about the esp trick: some packers push all registers on the stack, and when unpacking is done, they are restored. Placing a hardware breakpoint on esp we can stop there and get the ...
1
vote
2answers
273 views

Adding Features to a Released PC Game

I've just recently finished a C++ class at my university, and I'm curious about game-modding/reverse engineering. My ultimate goal is to add features that were missing from the latest version of a ...
0
votes
1answer
2k views

what is IAT? and how to find the end of the IAT in packed exe?

I recently started to study RE in my free time. I started to look at lena151 free tutorials and now I'm on packers/protectors. Now i reached to the part that he show how to manually find the end of ...
1
vote
1answer
520 views

How to decompress SHA1[compressed] executable

I have struggled a lot to reverse an app that is delphi executable. So I trusted PEiD to tell me the truth about the app but unfortunately I found these Nothing found[overlay]* Then I switched the ...
4
votes
2answers
4k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
6
votes
0answers
732 views

Audio file compression identification

I've been working on reversing file formats from the game of star wars episode 1: the phantom menace. I have managed to extract the audio files from the .lab file in which they were contained. I ...
5
votes
2answers
4k views

IDA Pro failed to display the program in graph mode

i am a complete beginner with IDA and I have just tried to follow a tutorial on how to unpack UPX. In the tutorial IDA looks like this: When I try to get the graphical view like in the tutorial an ...
2
votes
1answer
1k views

Does Windows 7 Pro use ASLR for win32 executable?

I unpacked a UPX packed PE binary. Both the packed and unpacked binary have fixed image base of 0x400000 (Checked by various PE tools). However, every time I run the program in OllyDbg, the image ...
0
votes
1answer
206 views

Service for unpacking custom protected exes? [closed]

Is there any free/paid service on internet to unpack custom protected exes? I am a RE but unpacking is not my expertise. Thanks
3
votes
1answer
921 views

Debugging a DOS4GW/Causeway packed program

I have a DOS program that I'm trying to reverse engineer. It uses the Causeway Extender(also known as DOS4GW) in order to load the program into 32-bit protected mode, and IDA Pro 5.0 cannot extract ...