Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [upx]

the Ultimate Packer for eXecutables is a free, multiplatform, open-source executables packer.

1
vote
2answers
149 views

Manually unpacking upx

As a first unpacking exercise, I decided to try to unpack the famous UPX (without using upx -d of course). I chose an executable I had somewhere, built from C++ code in debug mode. I packed it using ...
0
votes
0answers
224 views

Upx “anti-unpacking” techniques

How can I prevent UPX from unpacking my executable so easy? So that "upx -d xxx" doesn't work. I tried lots of things but nothing worked.
-1
votes
1answer
110 views

Unpacking UPX OSX files

I was wondering if someone could provide me an UPX unpacker, which works with unix excutable files. I've tried a bunch of already, but all of those expect .EXE's which obviously won't work for me. ...
0
votes
1answer
121 views

Pyemu - cannot use PEPyEmu() module, Python

I want to run code from Gray Hat Python book for upx_unpacker. I have downloaded PyEmu, but when I run script I got this error: AttributeError: PEPyEmu instance has no attribute 'load' My script use ...
1
vote
1answer
579 views

Dose PE Explorer unpack upx executables?

I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe ...
0
votes
1answer
244 views

Newbie unpacking diffculties

I'm trying to unpack a small application I compiled with VS2015 (v140_xp) and packed with UPX 3.93 (option -1). The application checks for IsDebuggerPresent and uses std::cout, nothing fancy. The ...
3
votes
1answer
736 views

UPX packing/unpacking information preservation

If I pack an executable using UPX and then unpack the executable using UPX -d, the executables are not the same. I understand techniques for unpacking executables that are packed using UPX, but I was ...
4
votes
0answers
3k views

How to unpack manually an upx packed elf file

I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
2
votes
1answer
643 views

Why does Olly 2.01 fail to break at the module EP?

I was playing around with tutorials/white papers concerning unpacking, specifically UPX. As Olly 2.01 is my debugger of choice, I attempted to unpack an UPX-packed exe with it and to my surprise, it ...
2
votes
2answers
15k views

Unpacking UPX packed (possibly scrambled) executable

I've decided to reverse this crackme. Obviously it's packed. I was told by PeID that there is only UPX inside. Ok, but upx -d simple crashed that's why I've concluded that this UPX may be scrambled ...
3
votes
1answer
597 views

An issue when unpacking UPX

Since I love to play with the WinAPI or debugging in general, I decided to write a small unpacker for the open source PE executable packer UPX today (Windows version). In order to accomplish this, I ...
3
votes
1answer
148 views

Why does packing an executable add dependencies to my executable?

Looking at the structure of an executable in a PE viewer, I see that it imports functions from comctl32.dll and nothing else. However, when I run this executable through a packer (UPX), the resulting ...
4
votes
2answers
6k views

Decoding the UPX ELF header file

Still on my way to understand how to prevent the usage of the -d (decompress) option of UPX (see this question), I try to identify the header file of UPX in ELF executable files. Looking at the code, ...
12
votes
2answers
13k views

How to prevent “upx -d” on an UPX packed executable?

I recently read a tweet from Ange about a technique to fool UPX when the option -d (decompress) is called. I would like to know how this is working and, what are the technique to prevent an UPX ...
3
votes
1answer
680 views

Known publicly available modified UPX ELF packer [closed]

Anyone know of any publicly available modified versions of UPX for ELF? I.e. one that is not able to be unpacked using upx -d. The unpacking stub in the binary is slightly obfuscated. I am looking to ...
14
votes
3answers
876 views

What different UPX formats exist and how do they differ?

Recently I asked a question about detecting UPX compression. 0xC0000022L wanted to know if it was plain UPX. However until that point I only was aware of plain UPX. So my question is: What versions/...
8
votes
4answers
8k views

How to check if an ELF file is UPX packed?

I have an ELF file and want to know if it is UPX packed. How can I detect UPX compression in GNU/Linux?