Questions tagged [unpacking]

Reverting (statically or dynamically) the effect of a binary packer: recovering its original structure and code by removing compression, encryption, protections features..

Filter by
Sorted by
Tagged with
3
votes
4answers
9k views

Unpacking and dumping using ollydump

I am trying to learn how to unpack a malware. I am trying this with ollydbg. However, when I try to dump the unpacked using ollydump plugin. It prompts the error "Bad DOS signature!!". Could someone ...
-1
votes
1answer
565 views

How can I statically unpack a file packed with an unknown packer without executing it?

I want to implement a generic, static unpacker that can statically unpack files that have been packed with unknown packers. In fact, I want it to be able to unpack packers which I just think of. ...
2
votes
2answers
24k views

Unpacking UPX packed (possibly scrambled) executable

I've decided to reverse this crackme. Obviously it's packed. I was told by PeID that there is only UPX inside. Ok, but upx -d simple crashed that's why I've concluded that this UPX may be scrambled ...
1
vote
0answers
1k views

Bypassing Enigma loader

Currently I'm trying to get past Enigma's loader, which asks you for a name & key, as an excercise. I have very little progress, as I haven't worked too much with packers. What I did was ...
3
votes
1answer
2k views

What are indicators for hitting the OEP?

for me, it is sometimes difficult to decide if I have hit the OEP when I try to manuelly unpack it. Especially in cases, when it does not begin with the standard function prologue. For example: I ...
0
votes
1answer
56 views

How do I unpack a TBN File, meant for flashing a phone?

I have a file used to flash new firmware to a phone and I need to unpack it into smaller files that are contained in the "TBN" file. The smaller files that are contained in the TBN file are common ...
2
votes
2answers
1k views

Unpacking a backdoor program for studying

I wanted to learn something about unpacking malware manuelly and found the following link: writequit.org/blog/?p=165. As you can see, the malware in that example begins with the PUSHAD instruction....
0
votes
1answer
325 views

Why is IAT filled with static addresses instead of function names?

When a program is packed the OriginalFirstThunk tends to be discarded. When the loader resolves the imports, then how does it know which functions to look for? For some reason the IAT (FirstThunk) is ...
1
vote
2answers
427 views

Why isn't the import table ready at OEP?

When manually unpacking a program and ending up at the OEP, then why do we have to rebuild the import table? I understand that when packing, the import table is destroyed for compression/stealth, but ...
1
vote
2answers
1k views

debug a .dll compressed with pe compact

I am trying to load a DLL in IDA and OllyDbg, but it says the file is compressed. I checked with a couple of tools and came to know that the file is compressed with PECompact. I think it also has ...
0
votes
1answer
1k views

Windows CE + Itron RTOS image

I'm working on unpacking a firmware image, I managed to uncompress the original image but I'm stuck in the current step. First of all this is the current uncompressed image: https://www.dropbox.com/s/...
2
votes
1answer
357 views

Generate Mach-O binary from running process

I have a packed executable. To take care of the unpacking, I would like to extract the in-memory version of the process, which would ideally be rolled back into the equivalent Mach-O binary -- such ...
2
votes
1answer
1k views

Non standard LZ77 compression header

I'm working on reversing the SJ4000 camera firmware but I found a problem unpacking it. This is the header I found on the image: 00000000 42 43 4c 31 81 66 00 09 00 54 68 e0 00 2f 2b bf |BCL1.f......
4
votes
2answers
600 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
1
vote
0answers
315 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
2
votes
1answer
4k views

Unpacking a program which seems to be not packed?

I have downloaded a sample of a malware to analyze it. First, I opened it with PEiD to look if it is packed. PEiD gives me the following information: Microsoft Visual Basic 5.0/6.0 So, I assumed ...
2
votes
1answer
2k views

Why doesn't Olly's analyzation work properly in this code section?

I'm not sure if there are any legal hinderances to me asking this question, so if asking for unpacking advice is against the rules I apologize. I am new to reverse engineering and trying to manually ...
3
votes
1answer
700 views

An issue when unpacking UPX

Since I love to play with the WinAPI or debugging in general, I decided to write a small unpacker for the open source PE executable packer UPX today (Windows version). In order to accomplish this, I ...
1
vote
0answers
1k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
4
votes
2answers
288 views

Need help in figuring out checksum used in this small wireless packet

Need help in figuring out the checksum used for this small data packet. Packet is 48 bits long, I already have figured out most of the bits. Least 8 bits change even if there is a single bit change in ...
3
votes
0answers
630 views

Need help figuring out compression used on a PKDPX file from a Nintendo DS game

So, I've been working on reversing several file formats from the Nintendo DS game Pokemon Mystery Dungeon: Explorers of Sky. So far most formats were pretty easy to reverse, until I stumbled on a ...
0
votes
1answer
467 views

HASP implementation details [closed]

I realize this is a huge question but any insight you can provide will be much appreciated. OK, let's consider a file protected/wrapped by HASP. What's the general layout of said file? There's a HASP ...
4
votes
1answer
817 views

Unpacking a Digi Connect ME bin file

I'm working with a Digi Connect ME serial to Ethernet bridge, which runs a "Plug and Play" firmware by default. The specific product page is here. The part number is DC-ME-01T-S. It appears to be an ...
3
votes
2answers
12k views

How to force IDA to analyze a packed exe after the program has unpacked itself?

I know it is a very newbie question and sorry about that, but I can't really find any way how to make IDA analyze the code after the unpacking was done. What I mean is that when I unpack an exe and ...
3
votes
2answers
3k views

backup from ZynOS but, can not be decompressed with LZS

So I have this rom-0 file from Zyxel router P-660HW-T3 v3 and I would like to decompress it, I tried many tools, one of them you can find here the tool using lzs for decompression which works for some ...
2
votes
1answer
1k views

Unpacking script

As malware are often packed, I'm looking to automate some of the unpacking tasks when that's possible. In order to do that, I thought that OllyScript was an interesting way to write unpacking script ...
6
votes
2answers
4k views

How to find file compression or obfuscation type

The program I'm trying to decompile uses several supporting files: somesound.mp3 someimage.jpg etc.. The files are all located in the file system, not embedded into the exe. The files are used at ...
6
votes
3answers
5k views

unpack Clear spot .bin firmware update

I am trying to unpack a clear spot firmware update The firmware I am trying to reverse can be found on the download page of the vendor I have used the fwtools to unpack the firmware as described on ...
2
votes
3answers
370 views

How to zip or compress resources of your .NET application

I am a Windows application developer, I'd build a few .NET applications and I can see It is very easy to crack out resources of my Application even some simple applications like Resource Editor are ...
7
votes
1answer
3k views

Unpack Billion 5102 firmware

I'm trying to unpack this firmware image but I'm getting some issues understanding the structure. First of all I have one image which I called firmware.bin, and the file command shows me that it's a ...
5
votes
2answers
5k views

How to unpack files packed with multiple packers?

As I am just getting started in RE, I've mostly faced files packed with a single-layer of packing , such as UPX, ASPack, etc. Unpacking these protections is fully documented online. The problem ...
6
votes
2answers
1k views

Is there any tool which parses ollydbg run trace?

I'm currently working on a tool to automate several actions which relate to unpacking software. I would like to use the run trace of Ollydbg (1.10 preferred since it has many antidebug/usage/etc ...
1
vote
1answer
2k views

Unpacking an MST file without an MSI file

I've looked this up for a few days now, but I can only find software like MSTView or Orca, which both require an MSI file to unpack the MST. Is there a way to unpack an MST file without an MSI file?
4
votes
1answer
1k views

Can a debug-apk be reverse engineered to make it a release-apk?

I am making a system in which the users can create Android applications. I want them to give an option to download a debug apk so that they can try it out first. After that, they have to pay for it to ...
10
votes
1answer
815 views

What is import reconstruction and why is it necessary?

When reading about unpacking, I sometimes see an "import reconstruction" step. What is this and why is it necessary?
3
votes
2answers
12k views

Why my Resource Hacker doesn't work with some .EXE files

I use Resource Hacker Application for Reverse Engineering purposes, I've cracked 3 softwares by using this software, but it doesn't grab all .EXE, .DLL files. sometimes It says, This is not a valid ...
6
votes
1answer
2k views

Any idea how to decode this binary data?

I have binary data representing a table. Here's the data when I print it with Python's repr(): \xff\xff\x05\x04test\x02A\x05test1@\x04\x03@@\x04\x05@0\x00\x00@\x05\x05test2\x03\x05\x05test1\x06@0\x00\...
6
votes
3answers
3k views

Can't access process memory when dumping

I'm trying to analyse a piece of malware and after finding the OEP I'm having trouble dumping the process. Using LordPE (and IDA) I get an error saying "Couldn't grab process memory", I searched for ...
5
votes
3answers
885 views

Linux protectors: any good one out there?

I know no one that works as of today (i.e., kernels not way too old) and I wonder if anybody found or knows any protector for Linux either commercial, open source, used in malware, etc...
0
votes
4answers
3k views

Where to find a hard crackme [closed]

I'd like to improve my skill as a reverse engineer. And thus I am looking for a location to find these.
19
votes
4answers
6k views

How common are virtualized packers in the wild?

I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
17
votes
4answers
3k views

How can you reliably unpack a Windows driver manually?

When you unpack manually a Windows user-mode executable, you can easily break at its EntryPoint (or TLS), then trace until you reach the original EntryPoint. However that's not possible with a packed ...
6
votes
4answers
2k views

Unpacking binary statically

Say I have a binary that I'm not able to execute (for example it runs on some device that I don't have one of), but I can disassemble it. I can get the docs on the architecture. (It's MIPS little ...
40
votes
3answers
19k views

Unpacking binaries in a generic way

I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy ...