Questions tagged [upx]

the Ultimate Packer for eXecutables is a free, multiplatform, open-source executables packer.

Filter by
Sorted by
Tagged with
2
votes
1answer
43 views

How can you dump the unpacked version of a packed library/plugin from memory on macOS?

I'm dealing with a custom-upx packed library that I'm trying to unpack. System is macOS. Given it's a library/plugin, it doesn't have a standalone entrypoint. I ran it through a disassembler but wasn'...
1
vote
1answer
77 views

Problems with relocation when unpacking

I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly. I started with compressing my simple x64....
0
votes
0answers
45 views

problems with figuring out if its vmprotect or upx

my name is eleven and I'm new to reverse engineering and I have a question. after scanning my program I have wanted to reverse engineer I have walked into a problem. this is a program I'm trying to ...
2
votes
2answers
2k views

Manually unpacking upx

As a first unpacking exercise, I decided to try to unpack the famous UPX (without using upx -d of course). I chose an executable I had somewhere, built from C++ code in debug mode. I packed it using ...
-1
votes
1answer
572 views

Unpacking UPX OSX files

I was wondering if someone could provide me an UPX unpacker, which works with unix excutable files. I've tried a bunch of already, but all of those expect .EXE's which obviously won't work for me. ...
0
votes
1answer
225 views

Pyemu - cannot use PEPyEmu() module, Python

I want to run code from Gray Hat Python book for upx_unpacker. I have downloaded PyEmu, but when I run script I got this error: AttributeError: PEPyEmu instance has no attribute 'load' My script use ...
1
vote
1answer
1k views

Dose PE Explorer unpack upx executables?

I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe ...
0
votes
1answer
383 views

Newbie unpacking diffculties

I'm trying to unpack a small application I compiled with VS2015 (v140_xp) and packed with UPX 3.93 (option -1). The application checks for IsDebuggerPresent and uses std::cout, nothing fancy. The ...
4
votes
1answer
1k views

UPX packing/unpacking information preservation

If I pack an executable using UPX and then unpack the executable using UPX -d, the executables are not the same. I understand techniques for unpacking executables that are packed using UPX, but I was ...
6
votes
0answers
4k views

How to unpack manually an upx packed elf file

I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
2
votes
1answer
1k views

Why does Olly 2.01 fail to break at the module EP?

I was playing around with tutorials/white papers concerning unpacking, specifically UPX. As Olly 2.01 is my debugger of choice, I attempted to unpack an UPX-packed exe with it and to my surprise, it ...
4
votes
2answers
32k views

Unpacking UPX packed (possibly scrambled) executable

I've decided to reverse this crackme. Obviously it's packed. I was told by PeID that there is only UPX inside. Ok, but upx -d simple crashed that's why I've concluded that this UPX may be scrambled ...
3
votes
1answer
810 views

An issue when unpacking UPX

Since I love to play with the WinAPI or debugging in general, I decided to write a small unpacker for the open source PE executable packer UPX today (Windows version). In order to accomplish this, I ...
3
votes
1answer
175 views

Why does packing an executable add dependencies to my executable?

Looking at the structure of an executable in a PE viewer, I see that it imports functions from comctl32.dll and nothing else. However, when I run this executable through a packer (UPX), the resulting ...
5
votes
2answers
10k views

Decoding the UPX ELF header file

Still on my way to understand how to prevent the usage of the -d (decompress) option of UPX (see this question), I try to identify the header file of UPX in ELF executable files. Looking at the code, ...
12
votes
2answers
22k views

How to prevent “upx -d” on an UPX packed executable?

I recently read a tweet from Ange about a technique to fool UPX when the option -d (decompress) is called. I would like to know how this is working and, what are the technique to prevent an UPX ...
3
votes
1answer
904 views

Known publicly available modified UPX ELF packer [closed]

Anyone know of any publicly available modified versions of UPX for ELF? I.e. one that is not able to be unpacked using upx -d. The unpacking stub in the binary is slightly obfuscated. I am looking to ...
14
votes
3answers
1k views

What different UPX formats exist and how do they differ?

Recently I asked a question about detecting UPX compression. 0xC0000022L wanted to know if it was plain UPX. However until that point I only was aware of plain UPX. So my question is: What versions/...
7
votes
4answers
11k views

How to check if an ELF file is UPX packed?

I have an ELF file and want to know if it is UPX packed. How can I detect UPX compression in GNU/Linux?