Hot answers tagged

10 votes
Accepted

How can packers work despite mechanisms like Data Execution Prevention?

The unpacker will request a page of memory from the OS that is marked write and unpack the code into there. Once the unpacking is done it will use VirtualProtect on windows or mprotect on posix ...
user avatar
9 votes

What it takes to write a simple PE file packer from scratch?

This is a topic that has a ton of depth depending on how crazy you want to go but I'll try to break it down into chunks as much as possible and you can look at each one as much as you want. I'll ...
user avatar
  • 972
9 votes

VMProtect anti-debug method

VMProtect uses a few anti-debug techniques. Firstly, you aren't going to want to tackle them on your own because there is quite and exhaustive set of techniques to detect a debugger. Consider using an ...
user avatar
  • 253
6 votes
Accepted

Zte Reverse engineering config.bin file problem

The second CRC is the CRC of the header started from 0x10 to 0x28. The following script checks the config file based on the dbcCfgFileDecry function, which verify and decompress the config file from ...
user avatar
  • 1,731
6 votes
Accepted

Stone's PE Encrypter v2.0

Depending on what you're looking to accomplish, you have a handful of options: Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, ...
user avatar
  • 2,144
5 votes
Accepted

Information about packers

First, this article from Trustwave does an excellent job covering the topic thoroughly from a beginner's perspective (note: there are formatting errors throughout the article where it mashes two words ...
user avatar
  • 2,144
4 votes
Accepted

How to unpack kkrunchy executables?

For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip. Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option ...
user avatar
  • 1,602
4 votes

How can I statically unpack a file packed with an unknown packer without executing it?

You can't. You don't know how the file is packed, the only thing you have is the unpacking code in the file. You could try running the file through an emulator like QEMU, so the unpacking takes place ...
user avatar
4 votes
Accepted

What program can I use to detect protections used on a program and its libraries?

Also, try Detect It Easy. The project is alive and updated frequently.
4 votes

How to disassemble a packed .NET executable?

OK, I think I got it. The tool I needed was MegaDumper. (I couldn't find the executable on its Github, so I had to build it myself.) Then here's the steps how I used it: (I'm obviously doing all ...
user avatar
  • 1,275
4 votes
Accepted

Packers Material for learn how to unpack software

If you are just starting out learn Assembly and Study C, and don't try to learn how to "unpack" commercial protectors (They are commercial for a reason), even if you want to insist on the ...
user avatar
  • 316
3 votes
Accepted

Unpacking abo1.exe advanced buffer overflow challenge from www.binary-auditing.com

The file abo1.exe (MD5: 22702FBFC5B198080ACA8F0BE6F2DF0B) doesn't look packed to me. Looking at the PE structure we can see the entry point is in the .text section and the file has a few imports: ...
user avatar
  • 2,441
3 votes
Accepted

What's the packer/encrypter used with this file

I used PEiD & Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it. Exeinfo PE has more recent signatures (beware of gifs, though). EDIT: As @beatcracker said in ...
user avatar
3 votes

Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?

You could try TitanHide. It is a kernel-mode hiding driver for both x86 and x64 OSses. It has the following features: - ProcessDebugFlags (NtQueryInformationProcess) - ProcessDebugPort (...
user avatar
  • 1,602
3 votes
Accepted

How does IDA understand that the file was packed by packer?

IDA don't detect type of packer. Also, signatures are not used. Instead, it analyze PE-header: .idata section, entry point and import entries. This method is very accurate, has low false positives.
user avatar
  • 46
3 votes

Python: Adding a asection to a PE file

This isn't a language specific concept. The values you'll need to modify as they are (or are meant to be) referenced: !IMAGE_FILE_HEADER: - NumberOfSections !IMAGE_OPTIONAL_HEADER: - ...
user avatar
3 votes
Accepted

Unpacking xamarin mono dll from libmonodroid_bundle.app.so

Thanks to the original poster who figured it out (and the other suggestion for foremost). I had to audit some of our own xamarin apps and wanted to unpack the code so I have what an attacker would be ...
user avatar
  • 46
3 votes

Unpacking xamarin mono dll from libmonodroid_bundle.app.so

This works very well cross-platform. Make sure to install these python packages: sudo pip install pyelftools sudo pip install yara-python this will export all dlls from libmonodroid_bundle_app.so: ...
user avatar
  • 227
3 votes

How to protect a PE file?

You really cannot. You can only slow a reverser down The goal of the packer, crypter or anti debug methods, ect. is simply to slow the reverser . Eventually (if there is desire ) your code will be ...
user avatar
  • 723
2 votes

Does PeID signatures work with 64-Bit Portable Executable (EXE) files?

PEiD rules are only patterns, you can use them on whatever fileformat you want. Since PEiD is not maintained anymore, you may want to export your rules to another format, like yara.
user avatar
  • 2,486
2 votes

Detecting packed 64-bit Windows Portable Executable (EXE) files

protectionid supports x64 files no problem... and if you can think of anything i could add to it, just let me know and i'll see what i can do (new build is planned for halloween and it'll be a spooky '...
user avatar
  • 111
2 votes

Unable to dump a process

Malware can be removing/manipulating its own PE Header. void destroyPEHeaders(){ DWORD OldProtect = 0; char *pBaseAddr = (char*)GetModuleHandle(NULL); VirtualProtect(pBaseAddr,...
user avatar
2 votes
Accepted

What is Executable Compression?

Executable compression (AKA executable packing) is the idea that an PE, ELF and MACHO file formats were not fully designed to be compact for obvious reasons. In the past, when memory was scarce, ...
user avatar
  • 11.3k
2 votes

Unpacking xamarin mono dll from libmonodroid_bundle.app.so

Here is my solution to unpack the files in C#. I could not figure out how the 64 byte alignment works so I hard coded an offset of 0xD60 for the words that did not lie on the alignment boundary. I ...
user avatar
  • 223
2 votes

Problems with relocation when unpacking

i found a tool for unpacking UPX x64.exe it work for me. it is called XVolkolak v0.22 i found it here: http://ntinfo.biz/index.html its a universal tool so it can unpack other packers to. Good luck. ...
user avatar
  • 21
1 vote

Unpacking xamarin mono dll from libmonodroid_bundle.app.so

If you want to extract these packed files (assuming that they are, indeed, packed), I would suggest using a File Carver forensics tool - I use a Unix-based program, foremost. File Carvers can search ...
user avatar
  • 43
1 vote
Accepted

Dose PE Explorer unpack upx executables?

The product overview of PE Explorer states in several places that it will load PE files that are compressed with UPX. Open UPX-, Upack- and NsPack-compressed files seamlessly in PE Explorer, ...
user avatar
1 vote
Accepted

How to run and reconstruct a packed DLL in IDA Pro?

I have a memdump of the unpacked .dll, but I had trouble importing it manually in IDA. That doesn't seem like a promising route. This is exactly the way to go. Given the right offset, this should ...
user avatar
  • 2,806
1 vote

Hooking functions in a VMProtect'ed executable

If there's no way to debug it, use system mechanisms to load your DLL into protected process, then do whatever you like.
user avatar
  • 1,750
1 vote

Hooking functions in a VMProtect'ed executable

StrongOD can have unexpected behaviour if you are using Win7 as your debugging environment. Try to use ScyllaHide plugin with the VMProtect profile on, ignore Invalid or privileged instruction ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible