Questions tagged [unpacking]

Reverting (statically or dynamically) the effect of a binary packer: recovering its original structure and code by removing compression, encryption, protections features..

Filter by
Sorted by
Tagged with
0
votes
1answer
698 views

open source static or dynamic malware unpacker

I am looking for static and dynamic unpacker tools. I only found PE-Explorer the only can handle UPX packer. So I am carious to know is there any open source static or dynamic unpacker?
2
votes
1answer
4k views

What's the packer/encrypter used with this file

I used PEiD & Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it. could someone help with this issue? EDIT: As @beatcracker said in comments, using ExeinfoPe ...
3
votes
0answers
2k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
-1
votes
2answers
503 views

Stopping at the original entry point in a packed file

During manual unpacking, the first task is to find to original entry point. The program jumps there after the unpacking is done. I took the bin/ls file, and checked with readelf -h that the entry ...
2
votes
1answer
673 views

Unpacking and the ESP trick

I recently heard about the esp trick: some packers push all registers on the stack, and when unpacking is done, they are restored. Placing a hardware breakpoint on esp we can stop there and get the ...
1
vote
2answers
302 views

Adding Features to a Released PC Game

I've just recently finished a C++ class at my university, and I'm curious about game-modding/reverse engineering. My ultimate goal is to add features that were missing from the latest version of a ...
0
votes
1answer
3k views

what is IAT? and how to find the end of the IAT in packed exe?

I recently started to study RE in my free time. I started to look at lena151 free tutorials and now I'm on packers/protectors. Now i reached to the part that he show how to manually find the end of ...
1
vote
1answer
564 views

How to decompress SHA1[compressed] executable

I have struggled a lot to reverse an app that is delphi executable. So I trusted PEiD to tell me the truth about the app but unfortunately I found these Nothing found[overlay]* Then I switched the ...
4
votes
2answers
5k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
6
votes
0answers
815 views

Audio file compression identification

I've been working on reversing file formats from the game of star wars episode 1: the phantom menace. I have managed to extract the audio files from the .lab file in which they were contained. I ...
5
votes
2answers
5k views

IDA Pro failed to display the program in graph mode

i am a complete beginner with IDA and I have just tried to follow a tutorial on how to unpack UPX. In the tutorial IDA looks like this: When I try to get the graphical view like in the tutorial an ...
2
votes
1answer
1k views

Does Windows 7 Pro use ASLR for win32 executable?

I unpacked a UPX packed PE binary. Both the packed and unpacked binary have fixed image base of 0x400000 (Checked by various PE tools). However, every time I run the program in OllyDbg, the image ...
0
votes
1answer
212 views

Service for unpacking custom protected exes? [closed]

Is there any free/paid service on internet to unpack custom protected exes? I am a RE but unpacking is not my expertise. Thanks
3
votes
1answer
1k views

Debugging a DOS4GW/Causeway packed program

I have a DOS program that I'm trying to reverse engineer. It uses the Causeway Extender(also known as DOS4GW) in order to load the program into 32-bit protected mode, and IDA Pro 5.0 cannot extract ...
1
vote
0answers
864 views

Extract resources from compiled “resource file”

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
1
vote
0answers
113 views

unpack a malware manually [duplicate]

I`m working on this malware to analyze: http://www.freeuploadsite.com/do.php?id=74209 password: infected It seems it is packed but when I use "PE View" , etc tools to find the packer, their results ...
4
votes
2answers
2k views

How to extract the filesystem from a I240w-A firmware

I am trying to extract this ONT I240w-A firmware and binwalk reports some LZMA compressed data (dump below) but the fact the all of them read "uncompressed size: -1 bytes" makes me suspect they are ...
2
votes
1answer
1k views

Adding exception range to IDA

I encountered a problem while trying to debug an application that raises an exception to stop the debugger. How can I add an exception range, such as (00000000 - FFFFFFFF), in IDA as in Olly ?
1
vote
1answer
308 views

Unpacking abo1.exe advanced buffer overflow challenge from www.binary-auditing.com

It seems abo1.exe advanced_buffer_overflow challenge is packed, I've tried to unpack it, but I am still beginner in unpacking.It seems it is packed manually. I've also tried OllyDump and ImortREC. ...
3
votes
1answer
5k views

Set memory breakpoing on access on a section in IDA

Is there a way to set memory breakpoint on Access on IDA in Win32 debugger... like we do in Olly from the memory window ? I tried to do that with the example "UnPackMe_NoNamePacker.d.out.exe" in 20th ...
6
votes
2answers
2k views

How are obfuscators detected?

I'm guessing that tools like PeiD detect packers by looking for signatures inside the packed binary and by measuring the entropy. Is there any other work that tries to determine if a binary is ...
2
votes
2answers
9k views

Packed PE-file, where to start?

I'm new to reverse engineering, so maybe it's an easy question but not for me). I've got .exe file which is somehow packed. When I open it with IDA, I got warning that file was packed or modified, and ...
1
vote
1answer
6k views

Unpacking Asprotect SKE 2.1

Since AsProtect is pretty dated, I was wondering if there is any tools out there that can do the unpacking for the user. If not, I guess manual is the way to go. In case of manual mode, I would love ...
1
vote
3answers
1k views

Best and smarter way to improve unpacking skills

I want to find a way to improve my unpacking skills, i am not a noob but i miss steps from simple to hard packers. I saw lot of video tutorials, the most of the time i see "click F9 x times to reach ...
3
votes
2answers
5k views

Fixing import table of unpacked DLL with ImpREC : ImpRec throws “invalid OEP!” error

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried. Modified the flag in its PE header so that windows loads the ...
3
votes
4answers
11k views

Unpacking and dumping using ollydump

I am trying to learn how to unpack a malware. I am trying this with ollydbg. However, when I try to dump the unpacked using ollydump plugin. It prompts the error "Bad DOS signature!!". Could someone ...
-1
votes
1answer
645 views

How can I statically unpack a file packed with an unknown packer without executing it?

I want to implement a generic, static unpacker that can statically unpack files that have been packed with unknown packers. In fact, I want it to be able to unpack packers which I just think of. ...
6
votes
2answers
40k views

Unpacking UPX packed (possibly scrambled) executable

I've decided to reverse this crackme. Obviously it's packed. I was told by PeID that there is only UPX inside. Ok, but upx -d simple crashed that's why I've concluded that this UPX may be scrambled ...
2
votes
0answers
1k views

Bypassing Enigma loader

Currently I'm trying to get past Enigma's loader, which asks you for a name & key, as an excercise. I have very little progress, as I haven't worked too much with packers. What I did was ...
3
votes
1answer
2k views

What are indicators for hitting the OEP?

for me, it is sometimes difficult to decide if I have hit the OEP when I try to manuelly unpack it. Especially in cases, when it does not begin with the standard function prologue. For example: I ...
0
votes
1answer
69 views

How do I unpack a TBN File, meant for flashing a phone?

I have a file used to flash new firmware to a phone and I need to unpack it into smaller files that are contained in the "TBN" file. The smaller files that are contained in the TBN file are common ...
2
votes
2answers
1k views

Unpacking a backdoor program for studying

I wanted to learn something about unpacking malware manuelly and found the following link: writequit.org/blog/?p=165. As you can see, the malware in that example begins with the PUSHAD instruction....
0
votes
1answer
387 views

Why is IAT filled with static addresses instead of function names?

When a program is packed the OriginalFirstThunk tends to be discarded. When the loader resolves the imports, then how does it know which functions to look for? For some reason the IAT (FirstThunk) is ...
1
vote
2answers
469 views

Why isn't the import table ready at OEP?

When manually unpacking a program and ending up at the OEP, then why do we have to rebuild the import table? I understand that when packing, the import table is destroyed for compression/stealth, but ...
1
vote
2answers
2k views

debug a .dll compressed with pe compact

I am trying to load a DLL in IDA and OllyDbg, but it says the file is compressed. I checked with a couple of tools and came to know that the file is compressed with PECompact. I think it also has ...
0
votes
1answer
2k views

Windows CE + Itron RTOS image

I'm working on unpacking a firmware image, I managed to uncompress the original image but I'm stuck in the current step. First of all this is the current uncompressed image: https://www.dropbox.com/s/...
2
votes
1answer
403 views

Generate Mach-O binary from running process

I have a packed executable. To take care of the unpacking, I would like to extract the in-memory version of the process, which would ideally be rolled back into the equivalent Mach-O binary -- such ...
2
votes
1answer
2k views

Non standard LZ77 compression header

I'm working on reversing the SJ4000 camera firmware but I found a problem unpacking it. This is the header I found on the image: 00000000 42 43 4c 31 81 66 00 09 00 54 68 e0 00 2f 2b bf |BCL1.f......
5
votes
2answers
667 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
1
vote
0answers
351 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
2
votes
1answer
5k views

Unpacking a program which seems to be not packed?

I have downloaded a sample of a malware to analyze it. First, I opened it with PEiD to look if it is packed. PEiD gives me the following information: Microsoft Visual Basic 5.0/6.0 So, I assumed ...
3
votes
1answer
2k views

Why doesn't Olly's analyzation work properly in this code section?

I'm not sure if there are any legal hinderances to me asking this question, so if asking for unpacking advice is against the rules I apologize. I am new to reverse engineering and trying to manually ...
3
votes
1answer
905 views

An issue when unpacking UPX

Since I love to play with the WinAPI or debugging in general, I decided to write a small unpacker for the open source PE executable packer UPX today (Windows version). In order to accomplish this, I ...
2
votes
0answers
2k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
4
votes
2answers
294 views

Need help in figuring out checksum used in this small wireless packet

Need help in figuring out the checksum used for this small data packet. Packet is 48 bits long, I already have figured out most of the bits. Least 8 bits change even if there is a single bit change in ...
4
votes
0answers
704 views

Need help figuring out compression used on a PKDPX file from a Nintendo DS game

So, I've been working on reversing several file formats from the Nintendo DS game Pokemon Mystery Dungeon: Explorers of Sky. So far most formats were pretty easy to reverse, until I stumbled on a ...
0
votes
1answer
523 views

HASP implementation details [closed]

I realize this is a huge question but any insight you can provide will be much appreciated. OK, let's consider a file protected/wrapped by HASP. What's the general layout of said file? There's a HASP ...
4
votes
1answer
883 views

Unpacking a Digi Connect ME bin file

I'm working with a Digi Connect ME serial to Ethernet bridge, which runs a "Plug and Play" firmware by default. The specific product page is here. The part number is DC-ME-01T-S. It appears to be an ...
3
votes
2answers
15k views

How to force IDA to analyze a packed exe after the program has unpacked itself?

I know it is a very newbie question and sorry about that, but I can't really find any way how to make IDA analyze the code after the unpacking was done. What I mean is that when I unpack an exe and ...
3
votes
2answers
4k views

backup from ZynOS but, can not be decompressed with LZS

So I have this rom-0 file from Zyxel router P-660HW-T3 v3 and I would like to decompress it, I tried many tools, one of them you can find here the tool using lzs for decompression which works for some ...