24 votes

Decoding an unknown image format with "DREK" signature (*.drk)

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size ...
  • 1,384
19 votes
Accepted

Unpacking a Themida packed x64 executable?

Unpacking Themida, especially the newer versions, is not a small task by any means. It is literally worlds different from unpacking UPX and if you are new to unpacking, you have absolutely no business ...
  • 1,738
11 votes
Accepted

Unpacking UPX packed (possibly scrambled) executable

Here you can find bunch of tools for unpacking upx. One of them(Upx Unpacker 0.2) solved my issue. Every unpacker should be used in specific case and this list may be incomplete.
  • 803
11 votes
Accepted

How can I determine if a piece of code is an encryption algorithm?

TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
  • 11.6k
9 votes
Accepted

UPX packing/unpacking information preservation

If you compare the hash values of original/unpacked files, then they are different since upx -d does not restore bit-by-bit of the original file. Indeed, UPX parses the original file and keeps only ...
9 votes
Accepted

What are the steps, to extract an unknown archive file in this case?

I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack. ...
  • 2,334
8 votes

How are obfuscators detected?

I wouldn't say that obfuscation detection is strictly related to entropy. When I detected obfuscated code areas I did it by simple statistical comparison of probabilities of appearances of specific ...
  • 8,185
7 votes

How to unpack(carve) files from a camera firmware .bin file?

From brief analysis of the file it looks that the Insta360 One camera is based on or variant of the Ambarella A9 SoC. So lets assume for the moment that we are dealing with Ambarella camera itself and ...
  • 2,972
7 votes
Accepted

Manually unpacking upx

You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed. Easiest ...
  • 116
6 votes

Unpacking a backdoor program for studying

Your mistake is that you put the breakpoint while being on the PUSHAD instruction (meaning it wasn't executed yet). I just unpacked the file, and this is how you do it: 1. Drop the file in Olly and ...
  • 1,283
6 votes
Accepted

Best and smarter way to improve unpacking skills

There is not a single paper or book that explains the art of unpacking. This is mainly due to all the different packers that require different techniques to unpack them. There are of course generic ...
  • 1,062
6 votes
Accepted

Zte Reverse engineering config.bin file problem

The second CRC is the CRC of the header started from 0x10 to 0x28. The following script checks the config file based on the dbcCfgFileDecry function, which verify and decompress the config file from ...
  • 1,749
6 votes
Accepted

Why to dump precisely at OEP while manual unpacking?

But how does knowing OEP relate to IAT? OEP does not relate to the IAT, but is used by import reconstruction tools to find the location of IAT-like structures created by the packer. When ...
  • 11.6k
6 votes
Accepted

Stone's PE Encrypter v2.0

Depending on what you're looking to accomplish, you have a handful of options: Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, ...
  • 2,194
6 votes
Accepted

Finding OEP in a VMProtect v3.0 protected malware

Here are a few links that address your question in a broad manner: VMAttack: Deobfuscating Virtualization-Based Packed Binaries Link to PDF Paper which uses the VMAttack IDA PRO Plugin. Unpacking ...
  • 136
5 votes

Reversing Hisense TV Firmware

My achievements. I added to the startup telnetd, and ftpd. I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve ...
  • 51
5 votes
Accepted

what is IAT? and how to find the end of the IAT in packed exe?

I didn't completely understood what is IAT, any help will be great :-) The IAT is the Import Address Table. It's an an array of pointers to statically-imported API function addresses. The IAT entries ...
5 votes
Accepted

Unpacking and the ESP trick

Placing a hardware breakpoint on esp we can stop there and get the original entry point. Why is it necessary to use a hardware breakpoint? The value of ESP is an address on the stack. The data ...
5 votes
Accepted

Unpack .apk file from a PC game (NOT Android related)

Update: I've done a write up on the entire file format here: https://tkte.ch/articles/2017/02/27/air-strike-3d.html These files aren't compressed, so don't worry about that. Since all you want to do ...
  • 326
5 votes

Reversing Self-Modifying Malware

Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
  • 4,596
5 votes

Animal Crossing: Pocket Camp .zdat File

The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
  • 326
5 votes
Accepted

Extracting compressed firmware (NRV) for analysis

NRV is a compressor-decompressor, highly optimized for size and speed, by Markus F.X.J. Oberhumer (www.oberhumer.com). Fortunately, it is available in an Open Source version, downloadable at his site ...
  • 1,934
5 votes
Accepted

Automating bypassing anti-debug checks

What you could do: With each found anti-debug, patch the exe with the bypass and continue with the patched one. If your debugger is scriptable (like e.g. Ida) run it under the script, insert ...
  • 1,934
4 votes

Best and smarter way to improve unpacking skills

Unpacking is an art, and as such there aren't clear steps to unpack any target. I was in your situation a few years ago. I understood assembly, and code injections and hooking and whatnot, but I ...
4 votes

How can I statically unpack a file packed with an unknown packer without executing it?

You can't. You don't know how the file is packed, the only thing you have is the unpacking code in the file. You could try running the file through an emulator like QEMU, so the unpacking takes place ...
4 votes

Unpacking UPX packed (possibly scrambled) executable

You should try to unpack it manually and reconstruct the IAT. With UPX, it should be pretty straightforward. Here is a tutorial in case you don't know how to start : https://web.archive.org/web/...
  • 565
4 votes
Accepted

Set memory breakpoing on access on a section in IDA

IDA doesn't do the kind of memory breakpoints that Olly implements. Olly implements memory breakpoints by changing the page protection, catching the exception, and then examining some extra data to ...
4 votes
Accepted

How to extract the filesystem from a I240w-A firmware

All the LZMA entries appear to be valid, and decompress to tar archives (-1 is a valid file size, and is used when the compressor doesn't know the size of the original data, such as when the data is ...
  • 2,664
4 votes

IDA Pro failed to display the program in graph mode

IDA can only display functions in graphical mode if they have a well-defined start and end address. Normally, the start and end address are determined from the disassembly - the start address is the ...
4 votes
Accepted

Decoding an unknown image format with "DREK" signature (*.drk)

I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
  • 56

Only top scored, non community-wiki answers of a minimum length are eligible