10
votes
Accepted
How can packers work despite mechanisms like Data Execution Prevention?
The unpacker will request a page of memory from the OS that is marked write and unpack the code into there. Once the unpacking is done it will use VirtualProtect on windows or mprotect on posix ...
- 582
9
votes
What it takes to write a simple PE file packer from scratch?
This is a topic that has a ton of depth depending on how crazy you want to go but I'll try to break it down into chunks as much as possible and you can look at each one as much as you want. I'll ...
- 972
9
votes
VMProtect anti-debug method
VMProtect uses a few anti-debug techniques. Firstly, you aren't going to want to tackle them on your own because there is quite and exhaustive set of techniques to detect a debugger. Consider using an ...
- 253
6
votes
Accepted
Zte Reverse engineering config.bin file problem
The second CRC is the CRC of the header started from 0x10 to 0x28. The following script checks the config file based on the dbcCfgFileDecry function, which verify and decompress the config file from ...
- 1,731
6
votes
Accepted
Stone's PE Encrypter v2.0
Depending on what you're looking to accomplish, you have a handful of options:
Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, ...
- 2,144
5
votes
Accepted
Information about packers
First, this article from Trustwave does an excellent job covering the topic thoroughly from a beginner's perspective (note: there are formatting errors throughout the article where it mashes two words ...
- 2,144
4
votes
Accepted
How to unpack kkrunchy executables?
For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip.
Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option ...
- 1,602
4
votes
How can I statically unpack a file packed with an unknown packer without executing it?
You can't. You don't know how the file is packed, the only thing you have is the unpacking code in the file. You could try running the file through an emulator like QEMU, so the unpacking takes place ...
- 12.6k
4
votes
Accepted
What program can I use to detect protections used on a program and its libraries?
Also, try Detect It Easy. The project is alive and updated frequently.
4
votes
How to disassemble a packed .NET executable?
OK, I think I got it. The tool I needed was MegaDumper. (I couldn't find the executable on its Github, so I had to build it myself.)
Then here's the steps how I used it:
(I'm obviously doing all ...
- 1,275
4
votes
Accepted
Packers Material for learn how to unpack software
If you are just starting out learn Assembly and Study C, and don't try to learn how to "unpack" commercial protectors (They are commercial for a reason), even if you want to insist on the ...
- 316
3
votes
Accepted
Unpacking abo1.exe advanced buffer overflow challenge from www.binary-auditing.com
The file abo1.exe (MD5: 22702FBFC5B198080ACA8F0BE6F2DF0B) doesn't look packed to me. Looking at the PE structure we can see the entry point is in the .text section and the file has a few imports:
...
- 2,441
3
votes
Accepted
What's the packer/encrypter used with this file
I used PEiD & Stud_PE to get the packer/encrypter signature but
unfortunately they didn't detect it.
Exeinfo PE has more recent signatures (beware of gifs, though).
EDIT: As @beatcracker said in ...
- 148
3
votes
Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?
You could try TitanHide. It is a kernel-mode hiding driver for both x86 and x64 OSses. It has the following features:
- ProcessDebugFlags (NtQueryInformationProcess)
- ProcessDebugPort (...
- 1,602
3
votes
Accepted
How does IDA understand that the file was packed by packer?
IDA don't detect type of packer. Also, signatures are not used. Instead, it analyze PE-header: .idata section, entry point and import entries.
This method is very accurate, has low false positives.
- 46
3
votes
Python: Adding a asection to a PE file
This isn't a language specific concept. The values you'll need to modify as they are (or are meant to be) referenced:
!IMAGE_FILE_HEADER:
- NumberOfSections
!IMAGE_OPTIONAL_HEADER:
- ...
- 29
3
votes
Accepted
Unpacking xamarin mono dll from libmonodroid_bundle.app.so
Thanks to the original poster who figured it out (and the other suggestion for foremost). I had to audit some of our own xamarin apps and wanted to unpack the code so I have what an attacker would be ...
- 46
3
votes
Unpacking xamarin mono dll from libmonodroid_bundle.app.so
This works very well cross-platform. Make sure to install these python packages:
sudo pip install pyelftools
sudo pip install yara-python
this will export all dlls from libmonodroid_bundle_app.so:
...
- 227
3
votes
How to protect a PE file?
You really cannot. You can only slow a reverser down
The goal of the packer, crypter or anti debug methods, ect. is simply to slow the reverser . Eventually (if there is desire ) your code will be ...
- 723
2
votes
Does PeID signatures work with 64-Bit Portable Executable (EXE) files?
PEiD rules are only patterns, you can use them on whatever fileformat you want. Since PEiD is not maintained anymore, you may want to export your rules to another format, like yara.
- 2,486
2
votes
Detecting packed 64-bit Windows Portable Executable (EXE) files
protectionid supports x64 files no problem... and if you can think of anything i could add to it, just let me know and i'll see what i can do (new build is planned for halloween and it'll be a spooky '...
- 111
2
votes
Unable to dump a process
Malware can be removing/manipulating its own PE Header.
void destroyPEHeaders(){
DWORD OldProtect = 0;
char *pBaseAddr = (char*)GetModuleHandle(NULL);
VirtualProtect(pBaseAddr,...
- 51
2
votes
Accepted
What is Executable Compression?
Executable compression (AKA executable packing) is the idea that an PE, ELF and MACHO file formats were not fully designed to be compact for obvious reasons.
In the past, when memory was scarce, ...
- 11.3k
2
votes
Unpacking xamarin mono dll from libmonodroid_bundle.app.so
Here is my solution to unpack the files in C#.
I could not figure out how the 64 byte alignment works so I hard coded an offset of 0xD60 for the words that did not lie on the alignment boundary. I ...
- 223
2
votes
Problems with relocation when unpacking
i found a tool for unpacking UPX x64.exe it work for me.
it is called XVolkolak v0.22 i found it here: http://ntinfo.biz/index.html
its a universal tool so it can unpack other packers to.
Good luck.
...
- 21
1
vote
Unpacking xamarin mono dll from libmonodroid_bundle.app.so
If you want to extract these packed files (assuming that they are, indeed, packed), I would suggest using a File Carver forensics tool - I use a Unix-based program, foremost.
File Carvers can search ...
- 43
1
vote
Accepted
Dose PE Explorer unpack upx executables?
The product overview of PE Explorer states in several places that it will load PE files that are compressed with UPX.
Open UPX-, Upack- and NsPack-compressed files seamlessly in PE Explorer, ...
- 126
1
vote
Accepted
How to run and reconstruct a packed DLL in IDA Pro?
I have a memdump of the unpacked .dll, but I had trouble importing it manually in IDA. That doesn't seem like a promising route.
This is exactly the way to go. Given the right offset, this should ...
- 2,806
1
vote
Hooking functions in a VMProtect'ed executable
If there's no way to debug it, use system mechanisms to load your DLL into protected process, then do whatever you like.
- 1,750
1
vote
Hooking functions in a VMProtect'ed executable
StrongOD can have unexpected behaviour if you are using Win7 as your debugging environment. Try to use ScyllaHide plugin with the VMProtect profile on, ignore Invalid or privileged instruction ...
- 345
Only top scored, non community-wiki answers of a minimum length are eligible