24
votes
Decoding an unknown image format with "DREK" signature (*.drk)
[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit
First some input how I got here (for future readers trying to do the same for different format).
Image Data size
...
- 1,384
19
votes
Accepted
Unpacking a Themida packed x64 executable?
Unpacking Themida, especially the newer versions, is not a small task by any means. It is literally worlds different from unpacking UPX and if you are new to unpacking, you have absolutely no business ...
- 1,738
11
votes
Accepted
Unpacking UPX packed (possibly scrambled) executable
Here you can find bunch of tools for unpacking upx. One of them(Upx Unpacker 0.2) solved my issue. Every unpacker should be used in specific case and this list may be incomplete.
- 803
11
votes
Accepted
How can I determine if a piece of code is an encryption algorithm?
TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
- 11.6k
9
votes
Accepted
UPX packing/unpacking information preservation
If you compare the hash values of original/unpacked files, then they are different since upx -d does not restore bit-by-bit of the original file. Indeed, UPX parses the original file and keeps only ...
- 1,400
9
votes
Accepted
What are the steps, to extract an unknown archive file in this case?
I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack.
...
- 2,334
8
votes
How are obfuscators detected?
I wouldn't say that obfuscation detection is strictly related to entropy.
When I detected obfuscated code areas I did it by simple statistical comparison of probabilities of appearances of specific ...
- 8,185
7
votes
How to unpack(carve) files from a camera firmware .bin file?
From brief analysis of the file it looks that the Insta360 One camera is based on or variant of the Ambarella A9 SoC. So lets assume for the moment that we are dealing with Ambarella camera itself and ...
- 2,972
7
votes
Accepted
Manually unpacking upx
You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed.
Easiest ...
- 116
6
votes
Unpacking a backdoor program for studying
Your mistake is that you put the breakpoint while being on the PUSHAD instruction (meaning it wasn't executed yet).
I just unpacked the file, and this is how you do it:
1. Drop the file in Olly and ...
- 1,283
6
votes
Accepted
Best and smarter way to improve unpacking skills
There is not a single paper or book that explains the art of unpacking. This is mainly due to all the different packers that require different techniques to unpack them. There are of course generic ...
- 1,062
6
votes
Accepted
Zte Reverse engineering config.bin file problem
The second CRC is the CRC of the header started from 0x10 to 0x28. The following script checks the config file based on the dbcCfgFileDecry function, which verify and decompress the config file from ...
- 1,749
6
votes
Accepted
Why to dump precisely at OEP while manual unpacking?
But how does knowing OEP relate to IAT?
OEP does not relate to the IAT, but is used by import reconstruction tools to find the location of IAT-like structures created by the packer.
When ...
- 11.6k
6
votes
Accepted
Stone's PE Encrypter v2.0
Depending on what you're looking to accomplish, you have a handful of options:
Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, ...
- 2,194
6
votes
Accepted
Finding OEP in a VMProtect v3.0 protected malware
Here are a few links that address your question in a broad manner:
VMAttack: Deobfuscating Virtualization-Based Packed Binaries
Link to PDF Paper which uses the VMAttack IDA PRO Plugin.
Unpacking ...
- 136
5
votes
Reversing Hisense TV Firmware
My achievements.
I added to the startup telnetd, and ftpd.
I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve ...
- 51
5
votes
Accepted
what is IAT? and how to find the end of the IAT in packed exe?
I didn't completely understood what is IAT, any help will be great :-)
The IAT is the Import Address Table. It's an an array of pointers to statically-imported API function addresses. The IAT entries ...
- 20.6k
5
votes
Accepted
Unpacking and the ESP trick
Placing a hardware breakpoint on esp we can stop there and get the
original entry point.
Why is it necessary to use a hardware breakpoint?
The value of ESP is an address on the stack. The data ...
- 20.6k
5
votes
Accepted
Unpack .apk file from a PC game (NOT Android related)
Update: I've done a write up on the entire file format here: https://tkte.ch/articles/2017/02/27/air-strike-3d.html
These files aren't compressed, so don't worry about that. Since all you want to do ...
- 326
5
votes
Reversing Self-Modifying Malware
Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
- 4,596
5
votes
Animal Crossing: Pocket Camp .zdat File
The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
- 326
5
votes
Accepted
Extracting compressed firmware (NRV) for analysis
NRV is a compressor-decompressor, highly optimized for size and speed, by Markus F.X.J. Oberhumer (www.oberhumer.com). Fortunately, it is available in an Open Source version, downloadable at his site ...
- 1,934
5
votes
Accepted
Automating bypassing anti-debug checks
What you could do:
With each found anti-debug, patch the exe with the bypass and continue with the patched one.
If your debugger is scriptable (like e.g. Ida) run it under the script, insert ...
- 1,934
4
votes
Best and smarter way to improve unpacking skills
Unpacking is an art, and as such there aren't clear steps to unpack any target.
I was in your situation a few years ago. I understood assembly, and code injections and hooking and whatnot, but I ...
- 61
4
votes
How can I statically unpack a file packed with an unknown packer without executing it?
You can't. You don't know how the file is packed, the only thing you have is the unpacking code in the file. You could try running the file through an emulator like QEMU, so the unpacking takes place ...
- 12.8k
4
votes
Unpacking UPX packed (possibly scrambled) executable
You should try to unpack it manually and reconstruct the IAT. With UPX, it should be pretty straightforward. Here is a tutorial in case you don't know how to start : https://web.archive.org/web/...
- 565
4
votes
Accepted
Set memory breakpoing on access on a section in IDA
IDA doesn't do the kind of memory breakpoints that Olly implements. Olly implements memory breakpoints by changing the page protection, catching the exception, and then examining some extra data to ...
- 426
4
votes
Accepted
How to extract the filesystem from a I240w-A firmware
All the LZMA entries appear to be valid, and decompress to tar archives (-1 is a valid file size, and is used when the compressor doesn't know the size of the original data, such as when the data is ...
- 2,664
4
votes
IDA Pro failed to display the program in graph mode
IDA can only display functions in graphical mode if they have a well-defined start and end address. Normally, the start and end address are determined from the disassembly - the start address is the ...
- 12.8k
4
votes
Accepted
Decoding an unknown image format with "DREK" signature (*.drk)
I was able to decode the images. Spektre did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is ...
- 56
Only top scored, non community-wiki answers of a minimum length are eligible