[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit
First some input how I got here (for future readers trying to do the same for different format).
Image Data size
Comparing provided background image to its raw image size xs*ys reveal direct dependence Which implies no compression or one that has always the same pixel to ...
In a typical, non-packed Windows PE executable, the header contains metadata that describes to the operating system which symbols from other libraries that the executable depends upon. The operating system's loader is responsible for loading those libraries into memory (if they are not already loaded), and for placing the addresses of those imported symbols ...
Unpacking Themida, especially the newer versions, is not a small task by any means. It is literally worlds different from unpacking UPX and if you are new to unpacking, you have absolutely no business trying to unpack Themida. Here's why:
Themida uses an extremely complex virtual machine environment combined with every anti-debug and anti-analysis trick in ...
TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely similar to encryption.
Encryption algorithms are divided into two classes. First is a stream cipher. From wikipedia:
A stream cipher is a symmetric key cipher where ...
According to the developer of Resource Hacker, this product is discontinued (and hasn't been updated since Sep 2011):
I have been overwhelmed by the interest in Resource HackerTM, the
emails of thanks, encouragement and suggestions. It's been downloaded
many millions of times. However, I've moved on to other things and
have no plans to continue its ...
Your program is not packed, but rather compiled as Visual Basic P-code or Visual Basic native code.
If it's VB native code, you can use your favorite debugger (OllyDbg, IDA, etc.) to debug it, and IDA to disassemble it.
If it's VB P-code, you can use VB Decompiler Pro to disassemble/decompile it:
... and WKTVBDE to debug it:
Note that VB Decompiler Pro ...
If you compare the hash values of original/unpacked files, then they are different since upx -d does not restore bit-by-bit of the original file. Indeed, UPX parses the original file and keeps only information so that the packed data, after being unpacked, can be executed exactly the same as the original one, i.e. the original/unpacked files are semantically ...
I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack.
For the moment, skip the header "BigFile" and the immedtaly following data and concentrate on these filenames alone.
If the filenames have different lengths, ...
An alternative to patching the DriverInit function with an INT3 is to put a breakpoint in the IopLoadDriver function which is responsible for calling DriverInit. On Windows XP SP3, the breakpoint should be added at IopLoadDriver+0x66a which is call dword ptr [edi+2Ch] (0x2C is _DRIVER_OBJECT.DriverInit).
Find IopLoadDriver with x nt!IopLoadDriver
Add a ...
As you saw by yourself, RE is not a easy skill to accomplish. One must find as much patience (at least) as he could to acquire it, some intelligence and knowledge will also help. If you think that just following the tutorial you will understand all of it from the first read, then you are wrong.
My advice to you is :
read the tutorial several times and try ...
After you have finished unpacking the program and get to the OEP
File --> Plugins --> Universal Unpacker Manual Reconstruct
Fill in the info if its not correct :)
Ok, edit for free version:
Heres what I have done to get the program re-analyzed:
UPX packed notepad.exe (easy to unpack)
loaded packed file into freshly installed IDA Pro Free 5.0
I wouldn't say that obfuscation detection is strictly related to entropy.
When I detected obfuscated code areas I did it by simple statistical comparison of probabilities of appearances of specific assembly commands.
For example number of jump related commands will be significantly larger in a binary with control flow obfuscation.
Number of arithmetic ...
The CramFS image is a false positive; I doubt there would be over 1 billion files in a 5MB firmware image.
It looks like your binwalk signatures are a bit old; here is the output from mine (running the latest from the trunk):
DECIMAL HEX DESCRIPTION
The output from the file utility, as you've probably guessed, is a false positive. The beginning of the firmware.bin file contains what looks to be a basic header (note the "SIG" string near the beginning of the file), and a bunch of MIPS executable code, which is likely the bootloader:
DECIMAL HEX DESCRIPTION
The difference between a debug apk and a release apk is that a debug apk is signed by a particular key which is provided with the SDK, whereas a release apk is signed by some other key. There's nothing to reverse engineer: all you have to do to make a release apk and sign it.
Nobody but you can create an apk signed by you. But anyone can make their own ...
From brief analysis of the file it looks that the Insta360 One camera is based on or variant of the Ambarella A9 SoC. So lets assume for the moment that we are dealing with Ambarella camera itself and its firmware as it's pretty hard IMO to develop your own HD camera HW and SW stack from scratch. There are some substantial evidence for that if one check ...
nt!IopLoadDriver indirect call is used only for SERVICE_DEMAND start driver entry
for boot loading drivers you would need to break on nt!IopInitializeBuiltInDriver indirect call as well
you can see a short example on message #17 & #18 in this link
this is a dormant script (slightly edited to use gc ...
Because the code at 0x4164e3 is never referenced in a CALL or JMP instruction, but (probably) used as data somewhere else (as you said the program is self-modifying), Olly thinks it's data, and has no reason to assume there's code there. See https://stackoverflow.com/questions/13812554/in-ollydbg-how-do-you-force-hint-disassembly-at-a-location for how to ...
Your mistake is that you put the breakpoint while being on the PUSHAD instruction (meaning it wasn't executed yet).
I just unpacked the file, and this is how you do it:
1. Drop the file in Olly and find the PUSHAD instruction
Simply do what you did before, and end up here:
2. Step once to skip the PUSHAD
Now, you got everything pushed, and the ...
There is not a single paper or book that explains the art of unpacking. This is mainly due to all the different packers that require different techniques to unpack them. There are of course generic approaches that work on some packers but knowing when to use them is gained from experience. IMHO the best approach to learn unpacking is to follow along with ...
The second CRC is the CRC of the header started from 0x10 to 0x28. The following script checks the config file based on the dbcCfgFileDecry function, which verify and decompress the config file from offset 0x10.
if (len(sys.argv) < 1):
print 'usage: check_config.py config_file'
cf = open(sys.argv[...
Depending on what you're looking to accomplish, you have a handful of options:
Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, TitanEngine, has been immensely improved since its implementation back then, and is available as open source via ReversingLabs. Official video tutorial from RL can ...
Here are a few links that address your question in a broad manner:
VMAttack: Deobfuscating Virtualization-Based Packed Binaries
Link to PDF Paper which uses the VMAttack IDA PRO Plugin.
Unpacking Virtualization Obfuscators by Rolf Rolles.
Unpacking the FinSpy VM, parts #1, #2, #3
Various other articles by Rolf Rolles .
You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed.
Easiest solution is to disable ASLR and then unpack. If you want to disable ASLR on the packed executable, edit the IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE flag of the DLL ...
(I don't have quite enough reputation for a comment so please excuse a very partial answer.)
You need to consider whether some of the bits are not part of the packet data but part of an encoding for transmission.
e.g. the 1's at regularly spaced bit positions 8, 17, 26, 35 could well be there to prevent a run of 0's getting too long. (Knowing the ...
To Unpack a file you must have quite a lot of experience in reversing binaries..
Remember there exists no universal method that works for all the packers.
These steps will work in unpacking 97% of binaries;
You must be aware of the code that usually lies at the start of entry point in binaries compiled by well known compilers VC++, VB, Borland Delphi and ...
Blackstorm portal has a huge collection of Unpacking tutorials
Blackstorm portal tutorials
Tuts4You has another large collection of unpacking tutorials
It took me a long time at first but over time unpacking got a lot easier, lots of patience and practice required though.