Hot answers tagged

10 votes
Accepted

How can packers work despite mechanisms like Data Execution Prevention?

The unpacker will request a page of memory from the OS that is marked write and unpack the code into there. Once the unpacking is done it will use VirtualProtect on windows or mprotect on posix ...
ratchet freak's user avatar
9 votes

VMProtect anti-debug method

VMProtect uses a few anti-debug techniques. Firstly, you aren't going to want to tackle them on your own because there is quite and exhaustive set of techniques to detect a debugger. Consider using an ...
Jeremy's user avatar
  • 263
9 votes

What it takes to write a simple PE file packer from scratch?

This is a topic that has a ton of depth depending on how crazy you want to go but I'll try to break it down into chunks as much as possible and you can look at each one as much as you want. I'll ...
Fewmitz's user avatar
  • 1,022
6 votes
Accepted

Zte Reverse engineering config.bin file problem

The second CRC is the CRC of the header started from 0x10 to 0x28. The following script checks the config file based on the dbcCfgFileDecry function, which verify and decompress the config file from ...
ebux's user avatar
  • 1,759
6 votes
Accepted

Stone's PE Encrypter v2.0

Depending on what you're looking to accomplish, you have a handful of options: Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, ...
dsasmblr's user avatar
  • 2,234
5 votes
Accepted

Information about packers

First, this article from Trustwave does an excellent job covering the topic thoroughly from a beginner's perspective (note: there are formatting errors throughout the article where it mashes two words ...
dsasmblr's user avatar
  • 2,234
5 votes

How to disassemble a packed .NET executable?

OK, I think I got it. The tool I needed was MegaDumper. (I couldn't find the executable on its Github, so I had to build it myself.) Then here's the steps how I used it: (I'm obviously doing all ...
c00000fd's user avatar
  • 1,649
5 votes
Accepted

How do I reverse an exe packed with an unknown packer?

You don't throw things at IDA and hope for the best and, as an analyst, you don't relay on automatic tools this much. That's clearly a sign you need to start doing the heavy lifting. A packer is ...
Margaret Bloom's user avatar
4 votes
Accepted

How to unpack kkrunchy executables?

For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip. Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option ...
mrexodia's user avatar
  • 1,652
4 votes
Accepted

Packers Material for learn how to unpack software

If you are just starting out learn Assembly and Study C, and don't try to learn how to "unpack" commercial protectors (They are commercial for a reason), even if you want to insist on the ...
Happy's user avatar
  • 356
3 votes

How to protect a PE file?

You really cannot. You can only slow a reverser down The goal of the packer, crypter or anti debug methods, ect. is simply to slow the reverser . Eventually (if there is desire ) your code will be ...
LUser's user avatar
  • 783
3 votes
Accepted

What's the packer/encrypter used with this file

I used PEiD & Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it. Exeinfo PE has more recent signatures (beware of gifs, though). EDIT: As @beatcracker said in ...
beatcracker's user avatar
3 votes

Unpacking xamarin mono dll from libmonodroid_bundle.app.so

This works very well cross-platform. Make sure to install these python packages: sudo pip install pyelftools sudo pip install yara-python this will export all dlls from libmonodroid_bundle_app.so: ...
Zulakis's user avatar
  • 227
3 votes
Accepted

Unpacking xamarin mono dll from libmonodroid_bundle.app.so

Thanks to the original poster who figured it out (and the other suggestion for foremost). I had to audit some of our own xamarin apps and wanted to unpack the code so I have what an attacker would be ...
JR-Fire's user avatar
  • 46
3 votes

How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?

You can insert an infinite loop in the code that you can find once you attach to the process. Right click the method you want to put a breakpoint on and select Edit Method. Add an infinite loop ...
Ana María Martínez Gómez's user avatar
3 votes
Accepted

What is 0xCC between each functions?

Compilers may align function addresses to some boundary as part of the optimization process. When doing this, the gap between functions is filled with padding bytes that might accidentally run as code,...
Yotamz's user avatar
  • 1,093
2 votes

Unpacking xamarin mono dll from libmonodroid_bundle.app.so

Here is my solution to unpack the files in C#. I could not figure out how the 64 byte alignment works so I hard coded an offset of 0xD60 for the words that did not lie on the alignment boundary. I ...
rollsch's user avatar
  • 253
2 votes

Problems with relocation when unpacking

i found a tool for unpacking UPX x64.exe it work for me. it is called XVolkolak v0.22 i found it here: http://ntinfo.biz/index.html its a universal tool so it can unpack other packers to. Good luck. ...
Luffe's user avatar
  • 21
2 votes
Accepted

What is Executable Compression?

Executable compression (AKA executable packing) is the idea that an PE, ELF and MACHO file formats were not fully designed to be compact for obvious reasons. In the past, when memory was scarce, ...
NirIzr's user avatar
  • 11.8k
1 vote

Packer changed memory in IDA?

You are looking at 64bit code disassembled as 32bit code. dec eax sub esp, 28h is the byte pattern 48 83 ec 28, which is sub rsp, 28h As a rule of thumb, if you see a lot of dec eax out of place, ...
Johann Aydinbas's user avatar
1 vote

Problems with relocation when unpacking

AFAIK there is no existing tool but you should be able to create one using the approach used by DOS unpackers: Run the binary once, dump it at the entry point Run it second time, forcing the load ...
Igor Skochinsky's user avatar
  • 36.5k
1 vote
Accepted

PE file export functions of packed file

The presence or absence of exports alone is not enough to tell if a file is packed or unpacked. Most executables have no or very few exports but there are also legitimate executables with many exports....
Igor Skochinsky's user avatar
  • 36.5k
1 vote
Accepted

Dose PE Explorer unpack upx executables?

The product overview of PE Explorer states in several places that it will load PE files that are compressed with UPX. Open UPX-, Upack- and NsPack-compressed files seamlessly in PE Explorer, ...
Oliver Salzburg's user avatar
1 vote
Accepted

How to run and reconstruct a packed DLL in IDA Pro?

I have a memdump of the unpacked .dll, but I had trouble importing it manually in IDA. That doesn't seem like a promising route. This is exactly the way to go. Given the right offset, this should ...
Nordwald's user avatar
  • 2,896
1 vote

How to disassemble a packed .NET executable?

After you press 'Pause' you will end you in the message loop - that's ok. Go to the call-stack window and you should see your binary in on of the previous frames. Double click on one of them and dnSpy ...
Paweł Łukasik's user avatar
1 vote
Accepted

How detect version of VMProtect

Unfortunately there's no easy answer here. Most of these tools employ different types of heuristics to determine the version used. Often times just applying binary signatures which could be ...
NirIzr's user avatar
  • 11.8k
1 vote

Recreating a lzma archive (non-streamed)

It's likely that the lzma compressed archive you're working with was generated with an older library version, as Igor said. If you're recompressing the file with your system's built-in lzma command, ...
Rafi Mueen's user avatar
1 vote

Recreating a lzma archive (non-streamed)

It’s hard to say for sure, but probably you’re not using the same library version or compression parameters as the original program. The same data may be represented by different compressed streams, ...
Igor Skochinsky's user avatar
  • 36.5k
1 vote

Unpacking xamarin mono dll from libmonodroid_bundle.app.so

If you want to extract these packed files (assuming that they are, indeed, packed), I would suggest using a File Carver forensics tool - I use a Unix-based program, foremost. File Carvers can search ...
Alpha's user avatar
  • 43
1 vote

Hooking functions in a VMProtect'ed executable

If there's no way to debug it, use system mechanisms to load your DLL into protected process, then do whatever you like.
Anton Kukoba's user avatar
  • 1,840

Only top scored, non community-wiki answers of a minimum length are eligible