24 votes

Decoding an unknown image format with "DREK" signature (*.drk)

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size ...
Spektre's user avatar
  • 1,384
19 votes
Accepted

Unpacking a Themida packed x64 executable?

Unpacking Themida, especially the newer versions, is not a small task by any means. It is literally worlds different from unpacking UPX and if you are new to unpacking, you have absolutely no business ...
the_endian's user avatar
  • 1,860
11 votes
Accepted

How can I determine if a piece of code is an encryption algorithm?

TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
NirIzr's user avatar
  • 11.8k
9 votes
Accepted

UPX packing/unpacking information preservation

If you compare the hash values of original/unpacked files, then they are different since upx -d does not restore bit-by-bit of the original file. Indeed, UPX parses the original file and keeps only ...
Ta Thanh Dinh's user avatar
9 votes
Accepted

What are the steps, to extract an unknown archive file in this case?

I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack. ...
Jongware's user avatar
  • 2,364
8 votes
Accepted

Manually unpacking upx

You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed. Easiest ...
Anonymous's user avatar
  • 126
7 votes

How to unpack(carve) files from a camera firmware .bin file?

From brief analysis of the file it looks that the Insta360 One camera is based on or variant of the Ambarella A9 SoC. So lets assume for the moment that we are dealing with Ambarella camera itself and ...
PhoeniX's user avatar
  • 3,052
6 votes
Accepted

Why to dump precisely at OEP while manual unpacking?

But how does knowing OEP relate to IAT? OEP does not relate to the IAT, but is used by import reconstruction tools to find the location of IAT-like structures created by the packer. When ...
NirIzr's user avatar
  • 11.8k
6 votes
Accepted

Zte Reverse engineering config.bin file problem

The second CRC is the CRC of the header started from 0x10 to 0x28. The following script checks the config file based on the dbcCfgFileDecry function, which verify and decompress the config file from ...
ebux's user avatar
  • 1,759
6 votes
Accepted

Stone's PE Encrypter v2.0

Depending on what you're looking to accomplish, you have a handful of options: Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, ...
dsasmblr's user avatar
  • 2,234
6 votes
Accepted

Finding OEP in a VMProtect v3.0 protected malware

Here are a few links that address your question in a broad manner: VMAttack: Deobfuscating Virtualization-Based Packed Binaries Link to PDF Paper which uses the VMAttack IDA PRO Plugin. Unpacking ...
PeterG's user avatar
  • 136
5 votes

Reversing Hisense TV Firmware

My achievements. I added to the startup telnetd, and ftpd. I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve ...
hawkeye's user avatar
  • 51
5 votes
Accepted

Unpack .apk file from a PC game (NOT Android related)

Update: I've done a write up on the entire file format here: https://tkte.ch/articles/2017/02/27/air-strike-3d.html These files aren't compressed, so don't worry about that. Since all you want to do ...
TkTech's user avatar
  • 326
5 votes

Reversing Self-Modifying Malware

Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
peter ferrie's user avatar
  • 4,709
5 votes

Animal Crossing: Pocket Camp .zdat File

The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
TkTech's user avatar
  • 326
5 votes
Accepted

Extracting compressed firmware (NRV) for analysis

NRV is a compressor-decompressor, highly optimized for size and speed, by Markus F.X.J. Oberhumer (www.oberhumer.com). Fortunately, it is available in an Open Source version, downloadable at his site ...
josh's user avatar
  • 1,974
5 votes
Accepted

Automating bypassing anti-debug checks

What you could do: With each found anti-debug, patch the exe with the bypass and continue with the patched one. If your debugger is scriptable (like e.g. Ida) run it under the script, insert ...
josh's user avatar
  • 1,974
5 votes
Accepted

How do I reverse an exe packed with an unknown packer?

You don't throw things at IDA and hope for the best and, as an analyst, you don't relay on automatic tools this much. That's clearly a sign you need to start doing the heavy lifting. A packer is ...
Margaret Bloom's user avatar
4 votes

Why to dump precisely at OEP while manual unpacking?

I think there is something mixed up here. But how does knowing OEP relate to IAT? It does not (for benign software). However, the article you linked analyzes a packed executable. Often, malware ...
Nordwald's user avatar
  • 2,896
4 votes
Accepted

Decoding an unknown image format with "DREK" signature (*.drk)

I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
K-Adam's user avatar
  • 56
4 votes
Accepted

How to unpack kkrunchy executables?

For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip. Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option ...
mrexodia's user avatar
  • 1,652
4 votes
Accepted

binwalk showing "Unix path", how to extract the filesystem?

The abs file seems to contain an RTOS (real-time OS) image. In this case the code and the resources are compiled into a one large image without a real file system. So, you can't unpack or mount any ...
ebux's user avatar
  • 1,759
4 votes
Accepted

Unpacking UPX OSX files

Unless the binary has been modified to prevent it, UPX itself should be able to unpack it: upx -d packed.bin
Igor Skochinsky's user avatar
  • 36.6k
4 votes
Accepted

unpacking Download.img firmware for alcatel mw40

The file format consists of a file table starting at 0xC8 with each entry being: char filename[48] uint32_t position uint32_t size Where position indicates the position in the archive and size the ...
user29082's user avatar
  • 131
4 votes
Accepted

What is unpack? how to become professional Unpacker?

That's a set of very wide questions ... I'll try to answer as good as I can, but you are asking for something that is so broad, I'm afraid that I can't answer everything. What is unpacking? ...
Guillaume's user avatar
  • 709
3 votes
Accepted

Decoding LZSS buffer lookup indices

As already described in the updates to my question, it turned out that the compression algorithm is the standard LZSS algorithm with a 12 bit lookup index and 4 bit lookup length. They were just ...
Mario Gu's user avatar
  • 191
3 votes

How to change the strings in rdata section of a executable file?

it is a tough and tedious task and completely error prone assuming you have this code compiled and executed the first string will have a 68 push opcode and the second string will have a FF35 push ...
blabb's user avatar
  • 16.4k
3 votes

Finding OEP in a VMProtect v3.0 protected malware

Set a breakpoint on the "VM exit" instruction (though there may be more than one of these if the sample is using the multiple VM option, whose proper name I don't recall). From here you can see where ...
Rolf Rolles's user avatar
  • 9,198
3 votes

Manually unpacking upx

Just set a breakpoint in 0x00ef674c. Press F9. When it hit the breakpoint, press F7 to go the original Entrypoint of the unpacked file. Just make sure that the EIP is the OEP.
ismael_akez's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible