Questions tagged [unpacking]

Reverting (statically or dynamically) the effect of a binary packer: recovering its original structure and code by removing compression, encryption, protections features..

Filter by
Sorted by
Tagged with
1
vote
0answers
792 views

Extract resources from compiled “resource file”

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
1
vote
0answers
112 views

unpack a malware manually [duplicate]

I`m working on this malware to analyze: http://www.freeuploadsite.com/do.php?id=74209 password: infected It seems it is packed but when I use "PE View" , etc tools to find the packer, their results ...
4
votes
2answers
2k views

How to extract the filesystem from a I240w-A firmware

I am trying to extract this ONT I240w-A firmware and binwalk reports some LZMA compressed data (dump below) but the fact the all of them read "uncompressed size: -1 bytes" makes me suspect they are ...
2
votes
1answer
1k views

Adding exception range to IDA

I encountered a problem while trying to debug an application that raises an exception to stop the debugger. How can I add an exception range, such as (00000000 - FFFFFFFF), in IDA as in Olly ?
1
vote
1answer
300 views

Unpacking abo1.exe advanced buffer overflow challenge from www.binary-auditing.com

It seems abo1.exe advanced_buffer_overflow challenge is packed, I've tried to unpack it, but I am still beginner in unpacking.It seems it is packed manually. I've also tried OllyDump and ImortREC. ...
3
votes
1answer
4k views

Set memory breakpoing on access on a section in IDA

Is there a way to set memory breakpoint on Access on IDA in Win32 debugger... like we do in Olly from the memory window ? I tried to do that with the example "UnPackMe_NoNamePacker.d.out.exe" in 20th ...
6
votes
2answers
2k views

How are obfuscators detected?

I'm guessing that tools like PeiD detect packers by looking for signatures inside the packed binary and by measuring the entropy. Is there any other work that tries to determine if a binary is ...
2
votes
2answers
8k views

Packed PE-file, where to start?

I'm new to reverse engineering, so maybe it's an easy question but not for me). I've got .exe file which is somehow packed. When I open it with IDA, I got warning that file was packed or modified, and ...
1
vote
1answer
5k views

Unpacking Asprotect SKE 2.1

Since AsProtect is pretty dated, I was wondering if there is any tools out there that can do the unpacking for the user. If not, I guess manual is the way to go. In case of manual mode, I would love ...
1
vote
3answers
1k views

Best and smarter way to improve unpacking skills

I want to find a way to improve my unpacking skills, i am not a noob but i miss steps from simple to hard packers. I saw lot of video tutorials, the most of the time i see "click F9 x times to reach ...
3
votes
2answers
4k views

Fixing import table of unpacked DLL with ImpREC : ImpRec throws “invalid OEP!” error

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried. Modified the flag in its PE header so that windows loads the ...
3
votes
4answers
9k views

Unpacking and dumping using ollydump

I am trying to learn how to unpack a malware. I am trying this with ollydbg. However, when I try to dump the unpacked using ollydump plugin. It prompts the error "Bad DOS signature!!". Could someone ...
-1
votes
1answer
593 views

How can I statically unpack a file packed with an unknown packer without executing it?

I want to implement a generic, static unpacker that can statically unpack files that have been packed with unknown packers. In fact, I want it to be able to unpack packers which I just think of. ...
4
votes
2answers
30k views

Unpacking UPX packed (possibly scrambled) executable

I've decided to reverse this crackme. Obviously it's packed. I was told by PeID that there is only UPX inside. Ok, but upx -d simple crashed that's why I've concluded that this UPX may be scrambled ...
1
vote
0answers
1k views

Bypassing Enigma loader

Currently I'm trying to get past Enigma's loader, which asks you for a name & key, as an excercise. I have very little progress, as I haven't worked too much with packers. What I did was ...
3
votes
1answer
2k views

What are indicators for hitting the OEP?

for me, it is sometimes difficult to decide if I have hit the OEP when I try to manuelly unpack it. Especially in cases, when it does not begin with the standard function prologue. For example: I ...
0
votes
1answer
58 views

How do I unpack a TBN File, meant for flashing a phone?

I have a file used to flash new firmware to a phone and I need to unpack it into smaller files that are contained in the "TBN" file. The smaller files that are contained in the TBN file are common ...
2
votes
2answers
1k views

Unpacking a backdoor program for studying

I wanted to learn something about unpacking malware manuelly and found the following link: writequit.org/blog/?p=165. As you can see, the malware in that example begins with the PUSHAD instruction....
0
votes
1answer
344 views

Why is IAT filled with static addresses instead of function names?

When a program is packed the OriginalFirstThunk tends to be discarded. When the loader resolves the imports, then how does it know which functions to look for? For some reason the IAT (FirstThunk) is ...
1
vote
2answers
438 views

Why isn't the import table ready at OEP?

When manually unpacking a program and ending up at the OEP, then why do we have to rebuild the import table? I understand that when packing, the import table is destroyed for compression/stealth, but ...
1
vote
2answers
2k views

debug a .dll compressed with pe compact

I am trying to load a DLL in IDA and OllyDbg, but it says the file is compressed. I checked with a couple of tools and came to know that the file is compressed with PECompact. I think it also has ...
0
votes
1answer
1k views

Windows CE + Itron RTOS image

I'm working on unpacking a firmware image, I managed to uncompress the original image but I'm stuck in the current step. First of all this is the current uncompressed image: https://www.dropbox.com/s/...
2
votes
1answer
376 views

Generate Mach-O binary from running process

I have a packed executable. To take care of the unpacking, I would like to extract the in-memory version of the process, which would ideally be rolled back into the equivalent Mach-O binary -- such ...
2
votes
1answer
2k views

Non standard LZ77 compression header

I'm working on reversing the SJ4000 camera firmware but I found a problem unpacking it. This is the header I found on the image: 00000000 42 43 4c 31 81 66 00 09 00 54 68 e0 00 2f 2b bf |BCL1.f......
4
votes
2answers
636 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
1
vote
0answers
328 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
2
votes
1answer
4k views

Unpacking a program which seems to be not packed?

I have downloaded a sample of a malware to analyze it. First, I opened it with PEiD to look if it is packed. PEiD gives me the following information: Microsoft Visual Basic 5.0/6.0 So, I assumed ...
2
votes
1answer
2k views

Why doesn't Olly's analyzation work properly in this code section?

I'm not sure if there are any legal hinderances to me asking this question, so if asking for unpacking advice is against the rules I apologize. I am new to reverse engineering and trying to manually ...
3
votes
1answer
765 views

An issue when unpacking UPX

Since I love to play with the WinAPI or debugging in general, I decided to write a small unpacker for the open source PE executable packer UPX today (Windows version). In order to accomplish this, I ...
1
vote
0answers
2k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
4
votes
2answers
291 views

Need help in figuring out checksum used in this small wireless packet

Need help in figuring out the checksum used for this small data packet. Packet is 48 bits long, I already have figured out most of the bits. Least 8 bits change even if there is a single bit change in ...
4
votes
0answers
669 views

Need help figuring out compression used on a PKDPX file from a Nintendo DS game

So, I've been working on reversing several file formats from the Nintendo DS game Pokemon Mystery Dungeon: Explorers of Sky. So far most formats were pretty easy to reverse, until I stumbled on a ...
0
votes
1answer
493 views

HASP implementation details [closed]

I realize this is a huge question but any insight you can provide will be much appreciated. OK, let's consider a file protected/wrapped by HASP. What's the general layout of said file? There's a HASP ...
4
votes
1answer
846 views

Unpacking a Digi Connect ME bin file

I'm working with a Digi Connect ME serial to Ethernet bridge, which runs a "Plug and Play" firmware by default. The specific product page is here. The part number is DC-ME-01T-S. It appears to be an ...
3
votes
2answers
13k views

How to force IDA to analyze a packed exe after the program has unpacked itself?

I know it is a very newbie question and sorry about that, but I can't really find any way how to make IDA analyze the code after the unpacking was done. What I mean is that when I unpack an exe and ...
3
votes
2answers
3k views

backup from ZynOS but, can not be decompressed with LZS

So I have this rom-0 file from Zyxel router P-660HW-T3 v3 and I would like to decompress it, I tried many tools, one of them you can find here the tool using lzs for decompression which works for some ...
2
votes
1answer
2k views

Unpacking script

As malware are often packed, I'm looking to automate some of the unpacking tasks when that's possible. In order to do that, I thought that OllyScript was an interesting way to write unpacking script ...
6
votes
2answers
5k views

How to find file compression or obfuscation type

The program I'm trying to decompile uses several supporting files: somesound.mp3 someimage.jpg etc.. The files are all located in the file system, not embedded into the exe. The files are used at ...
6
votes
3answers
5k views

unpack Clear spot .bin firmware update

I am trying to unpack a clear spot firmware update The firmware I am trying to reverse can be found on the download page of the vendor I have used the fwtools to unpack the firmware as described on ...
2
votes
3answers
375 views

How to zip or compress resources of your .NET application

I am a Windows application developer, I'd build a few .NET applications and I can see It is very easy to crack out resources of my Application even some simple applications like Resource Editor are ...
7
votes
1answer
3k views

Unpack Billion 5102 firmware

I'm trying to unpack this firmware image but I'm getting some issues understanding the structure. First of all I have one image which I called firmware.bin, and the file command shows me that it's a ...
5
votes
2answers
5k views

How to unpack files packed with multiple packers?

As I am just getting started in RE, I've mostly faced files packed with a single-layer of packing , such as UPX, ASPack, etc. Unpacking these protections is fully documented online. The problem ...
6
votes
2answers
1k views

Is there any tool which parses ollydbg run trace?

I'm currently working on a tool to automate several actions which relate to unpacking software. I would like to use the run trace of Ollydbg (1.10 preferred since it has many antidebug/usage/etc ...
1
vote
1answer
2k views

Unpacking an MST file without an MSI file

I've looked this up for a few days now, but I can only find software like MSTView or Orca, which both require an MSI file to unpack the MST. Is there a way to unpack an MST file without an MSI file?
4
votes
1answer
1k views

Can a debug-apk be reverse engineered to make it a release-apk?

I am making a system in which the users can create Android applications. I want them to give an option to download a debug apk so that they can try it out first. After that, they have to pay for it to ...
10
votes
1answer
881 views

What is import reconstruction and why is it necessary?

When reading about unpacking, I sometimes see an "import reconstruction" step. What is this and why is it necessary?
3
votes
2answers
13k views

Why my Resource Hacker doesn't work with some .EXE files

I use Resource Hacker Application for Reverse Engineering purposes, I've cracked 3 softwares by using this software, but it doesn't grab all .EXE, .DLL files. sometimes It says, This is not a valid ...
6
votes
1answer
3k views

Any idea how to decode this binary data?

I have binary data representing a table. Here's the data when I print it with Python's repr(): \xff\xff\x05\x04test\x02A\x05test1@\x04\x03@@\x04\x05@0\x00\x00@\x05\x05test2\x03\x05\x05test1\x06@0\x00\...
6
votes
3answers
3k views

Can't access process memory when dumping

I'm trying to analyse a piece of malware and after finding the OEP I'm having trouble dumping the process. Using LordPE (and IDA) I get an error saying "Couldn't grab process memory", I searched for ...
5
votes
3answers
950 views

Linux protectors: any good one out there?

I know no one that works as of today (i.e., kernels not way too old) and I wonder if anybody found or knows any protector for Linux either commercial, open source, used in malware, etc...