9
votes
Accepted
UPX packing/unpacking information preservation
If you compare the hash values of original/unpacked files, then they are different since upx -d does not restore bit-by-bit of the original file. Indeed, UPX parses the original file and keeps only ...
8
votes
Accepted
Manually unpacking upx
You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed.
Easiest ...
4
votes
Accepted
Unpacking UPX OSX files
Unless the binary has been modified to prevent it, UPX itself should be able to unpack it:
upx -d packed.bin
3
votes
Manually unpacking upx
Just set a breakpoint in 0x00ef674c.
Press F9.
When it hit the breakpoint, press F7 to go the original Entrypoint of the unpacked file.
Just make sure that the EIP is the OEP.
3
votes
UPX Unpacking tool
upx itself unpacks binaries. Pass the -d option on the command line.
Example on a linux box
$ file exa
exa: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), statically linked, stripped
$ xxd ...
2
votes
Problems with relocation when unpacking
i found a tool for unpacking UPX x64.exe it work for me.
it is called XVolkolak v0.22 i found it here: http://ntinfo.biz/index.html
its a universal tool so it can unpack other packers to.
Good luck.
...
1
vote
UPX Unpacking tool
If the UPX header was intentionally broken after packing, you can give a try to this tool to restore it : https://github.com/NozomiNetworks/upx-recovery-tool
1
vote
How can you dump the unpacked version of a packed library/plugin from memory on macOS?
Basically you need to find the Mach-O header of the module in memory and dump the segments referred by it.
Here’s a tool which is not specifically for macOS, but should not be too difficult to modify ...
1
vote
Problems with relocation when unpacking
AFAIK there is no existing tool but you should be able to create one using the approach used by DOS unpackers:
Run the binary once, dump it at the entry point
Run it second time, forcing the load ...
1
vote
Pyemu - cannot use PEPyEmu() module, Python
Please check example usage in https://github.com/codypierce/pyemu/blob/master/examples/pepyemu.py. It looks like load method is not implemented.
Based on example usage it's required to load PE file ...
1
vote
Accepted
Dose PE Explorer unpack upx executables?
The product overview of PE Explorer states in several places that it will load PE files that are compressed with UPX.
Open UPX-, Upack- and NsPack-compressed files seamlessly in PE Explorer, ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
upx × 21unpacking × 10
packers × 6
linux × 2
elf × 2
dumping × 2
disassembly × 1
binary-analysis × 1
ollydbg × 1
c++ × 1
malware × 1
pe × 1
static-analysis × 1
python × 1
tools × 1
x64dbg × 1
memory-dump × 1
address × 1
entry-point × 1
import-reconstruction × 1
vmprotect × 1