24 votes

Decoding an unknown image format with "DREK" signature (*.drk)

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size ...
user avatar
  • 1,374
16 votes
Accepted

Unpacking a Themida packed x64 executable?

Unpacking Themida, especially the newer versions, is not a small task by any means. It is literally worlds different from unpacking UPX and if you are new to unpacking, you have absolutely no business ...
user avatar
  • 1,625
11 votes
Accepted

Unpacking UPX packed (possibly scrambled) executable

Here you can find bunch of tools for unpacking upx. One of them(Upx Unpacker 0.2) solved my issue. Every unpacker should be used in specific case and this list may be incomplete.
user avatar
  • 793
11 votes
Accepted

How can I determine if a piece of code is an encryption algorithm?

TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
user avatar
  • 11.4k
9 votes
Accepted

Unpacking a program which seems to be not packed?

Your program is not packed, but rather compiled as Visual Basic P-code or Visual Basic native code. If it's VB native code, you can use your favorite debugger (OllyDbg, IDA, etc.) to debug it, and ...
user avatar
9 votes
Accepted

UPX packing/unpacking information preservation

If you compare the hash values of original/unpacked files, then they are different since upx -d does not restore bit-by-bit of the original file. Indeed, UPX parses the original file and keeps only ...
user avatar
9 votes
Accepted

What are the steps, to extract an unknown archive file in this case?

I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack. ...
user avatar
  • 2,274
8 votes

How are obfuscators detected?

I wouldn't say that obfuscation detection is strictly related to entropy. When I detected obfuscated code areas I did it by simple statistical comparison of probabilities of appearances of specific ...
user avatar
  • 7,875
7 votes

How to unpack(carve) files from a camera firmware .bin file?

From brief analysis of the file it looks that the Insta360 One camera is based on or variant of the Ambarella A9 SoC. So lets assume for the moment that we are dealing with Ambarella camera itself and ...
user avatar
  • 2,852
7 votes
Accepted

Manually unpacking upx

You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed. Easiest ...
user avatar
  • 116
6 votes
Accepted

Best and smarter way to improve unpacking skills

There is not a single paper or book that explains the art of unpacking. This is mainly due to all the different packers that require different techniques to unpack them. There are of course generic ...
user avatar
  • 1,062
6 votes

Unpacking a backdoor program for studying

Your mistake is that you put the breakpoint while being on the PUSHAD instruction (meaning it wasn't executed yet). I just unpacked the file, and this is how you do it: 1. Drop the file in Olly and ...
user avatar
  • 1,253
6 votes

Need help in figuring out checksum used in this small wireless packet

(I don't have quite enough reputation for a comment so please excuse a very partial answer.) You need to consider whether some of the bits are not part of the packet data but part of an encoding for ...
user avatar
  • 2,229
6 votes
Accepted

Why doesn't Olly's analyzation work properly in this code section?

Because the code at 0x4164e3 is never referenced in a CALL or JMP instruction, but (probably) used as data somewhere else (as you said the program is self-modifying), Olly thinks it's data, and has no ...
user avatar
6 votes
Accepted

Zte Reverse engineering config.bin file problem

The second CRC is the CRC of the header started from 0x10 to 0x28. The following script checks the config file based on the dbcCfgFileDecry function, which verify and decompress the config file from ...
user avatar
  • 1,731
6 votes
Accepted

Stone's PE Encrypter v2.0

Depending on what you're looking to accomplish, you have a handful of options: Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, ...
user avatar
  • 2,154
6 votes
Accepted

Finding OEP in a VMProtect v3.0 protected malware

Here are a few links that address your question in a broad manner: VMAttack: Deobfuscating Virtualization-Based Packed Binaries Link to PDF Paper which uses the VMAttack IDA PRO Plugin. Unpacking ...
user avatar
  • 136
5 votes
Accepted

Non standard LZ77 compression header

I don't know for sure but can think of two possibilities. One is that it's simply a coding error and only the low half of the 32-bit register was initialized when the file was created. If that's ...
user avatar
  • 2,426
5 votes

Reversing Hisense TV Firmware

My achievements. I added to the startup telnetd, and ftpd. I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve ...
user avatar
  • 51
5 votes
Accepted

what is IAT? and how to find the end of the IAT in packed exe?

I didn't completely understood what is IAT, any help will be great :-) The IAT is the Import Address Table. It's an an array of pointers to statically-imported API function addresses. The IAT entries ...
user avatar
5 votes
Accepted

Unpack .apk file from a PC game (NOT Android related)

Update: I've done a write up on the entire file format here: https://tkte.ch/articles/2017/02/27/air-strike-3d.html These files aren't compressed, so don't worry about that. Since all you want to do ...
user avatar
  • 326
5 votes
Accepted

Why to dump precisely at OEP while manual unpacking?

But how does knowing OEP relate to IAT? OEP does not relate to the IAT, but is used by import reconstruction tools to find the location of IAT-like structures created by the packer. When ...
user avatar
  • 11.4k
5 votes

Reversing Self-Modifying Malware

Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
user avatar
  • 4,511
5 votes

Animal Crossing: Pocket Camp .zdat File

The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
user avatar
  • 326
5 votes
Accepted

Extracting compressed firmware (NRV) for analysis

NRV is a compressor-decompressor, highly optimized for size and speed, by Markus F.X.J. Oberhumer (www.oberhumer.com). Fortunately, it is available in an Open Source version, downloadable at his site ...
user avatar
  • 1,814
5 votes
Accepted

Automating bypassing anti-debug checks

What you could do: With each found anti-debug, patch the exe with the bypass and continue with the patched one. If your debugger is scriptable (like e.g. Ida) run it under the script, insert ...
user avatar
  • 1,814
4 votes

Unpacking UPX packed (possibly scrambled) executable

You should try to unpack it manually and reconstruct the IAT. With UPX, it should be pretty straightforward. Here is a tutorial in case you don't know how to start : https://web.archive.org/web/...
user avatar
  • 565
4 votes

What are indicators for hitting the OEP?

Magic constants can sometimes help even if the packer splits the startup code into tiny fragments with copious jumping around and 'returning' to pushed/swapped addresses and so on. One such example ...
user avatar
  • 1,960
4 votes
Accepted

Why is IAT filled with static addresses instead of function names?

When the loader resolves the imports, then how does it know which functions to look for? It parses the Import Table. For each entry, it parses the DLL name and associated function names and/or ...
user avatar
4 votes
Accepted

Why isn't the import table ready at OEP?

if we're already at the OEP, it must mean the program is ready to roll because the unpacking stub has repaired the import table already No, by the time the OEP is reached, the unpacking stub has ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible