24
votes
Decoding an unknown image format with "DREK" signature (*.drk)
[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit
First some input how I got here (for future readers trying to do the same for different format).
Image Data size
...
- 1,384
19
votes
Accepted
Unpacking a Themida packed x64 executable?
Unpacking Themida, especially the newer versions, is not a small task by any means. It is literally worlds different from unpacking UPX and if you are new to unpacking, you have absolutely no business ...
- 1,830
11
votes
Accepted
How can I determine if a piece of code is an encryption algorithm?
TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
- 11.7k
9
votes
Accepted
UPX packing/unpacking information preservation
If you compare the hash values of original/unpacked files, then they are different since upx -d does not restore bit-by-bit of the original file. Indeed, UPX parses the original file and keeps only ...
- 1,410
9
votes
Accepted
What are the steps, to extract an unknown archive file in this case?
I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack.
...
- 2,354
7
votes
How to unpack(carve) files from a camera firmware .bin file?
From brief analysis of the file it looks that the Insta360 One camera is based on or variant of the Ambarella A9 SoC. So lets assume for the moment that we are dealing with Ambarella camera itself and ...
- 3,002
7
votes
Accepted
Manually unpacking upx
You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed.
Easiest ...
- 116
6
votes
Accepted
Zte Reverse engineering config.bin file problem
The second CRC is the CRC of the header started from 0x10 to 0x28. The following script checks the config file based on the dbcCfgFileDecry function, which verify and decompress the config file from ...
- 1,759
6
votes
Accepted
Why to dump precisely at OEP while manual unpacking?
But how does knowing OEP relate to IAT?
OEP does not relate to the IAT, but is used by import reconstruction tools to find the location of IAT-like structures created by the packer.
When ...
- 11.7k
6
votes
Accepted
Stone's PE Encrypter v2.0
Depending on what you're looking to accomplish, you have a handful of options:
Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, ...
- 2,234
6
votes
Accepted
Finding OEP in a VMProtect v3.0 protected malware
Here are a few links that address your question in a broad manner:
VMAttack: Deobfuscating Virtualization-Based Packed Binaries
Link to PDF Paper which uses the VMAttack IDA PRO Plugin.
Unpacking ...
- 136
5
votes
Accepted
what is IAT? and how to find the end of the IAT in packed exe?
I didn't completely understood what is IAT, any help will be great :-)
The IAT is the Import Address Table. It's an an array of pointers to statically-imported API function addresses. The IAT entries ...
- 20.7k
5
votes
Accepted
Unpacking and the ESP trick
Placing a hardware breakpoint on esp we can stop there and get the
original entry point.
Why is it necessary to use a hardware breakpoint?
The value of ESP is an address on the stack. The data ...
- 20.7k
5
votes
Reversing Hisense TV Firmware
My achievements.
I added to the startup telnetd, and ftpd.
I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve ...
- 51
5
votes
Accepted
Unpack .apk file from a PC game (NOT Android related)
Update: I've done a write up on the entire file format here: https://tkte.ch/articles/2017/02/27/air-strike-3d.html
These files aren't compressed, so don't worry about that. Since all you want to do ...
- 326
5
votes
Reversing Self-Modifying Malware
Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
- 4,701
5
votes
Animal Crossing: Pocket Camp .zdat File
The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
- 326
5
votes
Accepted
Extracting compressed firmware (NRV) for analysis
NRV is a compressor-decompressor, highly optimized for size and speed, by Markus F.X.J. Oberhumer (www.oberhumer.com). Fortunately, it is available in an Open Source version, downloadable at his site ...
- 1,964
5
votes
Accepted
Automating bypassing anti-debug checks
What you could do:
With each found anti-debug, patch the exe with the bypass and continue with the patched one.
If your debugger is scriptable (like e.g. Ida) run it under the script, insert ...
- 1,964
5
votes
Accepted
How do I reverse an exe packed with an unknown packer?
You don't throw things at IDA and hope for the best and, as an analyst, you don't relay on automatic tools this much.
That's clearly a sign you need to start doing the heavy lifting.
A packer is ...
- 186
4
votes
Why to dump precisely at OEP while manual unpacking?
I think there is something mixed up here.
But how does knowing OEP relate to IAT?
It does not (for benign software). However, the article you linked analyzes a packed executable. Often, malware ...
- 2,896
4
votes
Accepted
How to unpack kkrunchy executables?
For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip.
Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option ...
- 1,652
4
votes
Accepted
Decoding an unknown image format with "DREK" signature (*.drk)
I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
- 56
4
votes
Accepted
binwalk showing "Unix path", how to extract the filesystem?
The abs file seems to contain an RTOS (real-time OS) image. In this case the code and the resources are compiled into a one large image without a real file system. So, you can't unpack or mount any ...
- 1,759
4
votes
Accepted
Unpacking UPX OSX files
Unless the binary has been modified to prevent it, UPX itself should be able to unpack it:
upx -d packed.bin
- 36.4k
4
votes
Accepted
unpacking Download.img firmware for alcatel mw40
The file format consists of a file table starting at 0xC8 with each entry being:
char filename[48]
uint32_t position
uint32_t size
Where position indicates the position in the archive and size the ...
- 131
4
votes
Accepted
What is unpack? how to become professional Unpacker?
That's a set of very wide questions ...
I'll try to answer as good as I can, but you are asking for something that is so broad, I'm afraid that I can't answer everything.
What is unpacking?
...
- 709
3
votes
Accepted
What's the packer/encrypter used with this file
I used PEiD & Stud_PE to get the packer/encrypter signature but
unfortunately they didn't detect it.
Exeinfo PE has more recent signatures (beware of gifs, though).
EDIT: As @beatcracker said in ...
- 158
3
votes
Reversing Hisense TV Firmware
Use binwalk to extract rootfs, then search for file passwd in /etc/
You will discover every users available. Look for root user, this should look like:
root:x3FrTg6uYT7.:0:0:root:/:/bin/sh
Recover ...
- 161
3
votes
Accepted
Decoding LZSS buffer lookup indices
As already described in the updates to my question, it turned out that the compression algorithm is the standard LZSS algorithm with a 12 bit lookup index and 4 bit lookup length. They were just ...
- 191
Only top scored, non community-wiki answers of a minimum length are eligible