9 votes
Accepted

UPX packing/unpacking information preservation

If you compare the hash values of original/unpacked files, then they are different since upx -d does not restore bit-by-bit of the original file. Indeed, UPX parses the original file and keeps only ...
Ta Thanh Dinh's user avatar
8 votes
Accepted

Manually unpacking upx

You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed. Easiest ...
Anonymous's user avatar
  • 126
4 votes
Accepted

Unpacking UPX OSX files

Unless the binary has been modified to prevent it, UPX itself should be able to unpack it: upx -d packed.bin
Igor Skochinsky's user avatar
  • 36.6k
3 votes

Manually unpacking upx

Just set a breakpoint in 0x00ef674c. Press F9. When it hit the breakpoint, press F7 to go the original Entrypoint of the unpacked file. Just make sure that the EIP is the OEP.
ismael_akez's user avatar
3 votes

UPX Unpacking tool

upx itself unpacks binaries. Pass the -d option on the command line. Example on a linux box $ file exa exa: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), statically linked, stripped $ xxd ...
Rolf Rolles's user avatar
  • 9,198
2 votes

Problems with relocation when unpacking

i found a tool for unpacking UPX x64.exe it work for me. it is called XVolkolak v0.22 i found it here: http://ntinfo.biz/index.html its a universal tool so it can unpack other packers to. Good luck. ...
Luffe's user avatar
  • 21
1 vote

UPX Unpacking tool

If the UPX header was intentionally broken after packing, you can give a try to this tool to restore it : https://github.com/NozomiNetworks/upx-recovery-tool
HellDiner's user avatar
1 vote

How can you dump the unpacked version of a packed library/plugin from memory on macOS?

Basically you need to find the Mach-O header of the module in memory and dump the segments referred by it. Here’s a tool which is not specifically for macOS, but should not be too difficult to modify ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Problems with relocation when unpacking

AFAIK there is no existing tool but you should be able to create one using the approach used by DOS unpackers: Run the binary once, dump it at the entry point Run it second time, forcing the load ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Pyemu - cannot use PEPyEmu() module, Python

Please check example usage in https://github.com/codypierce/pyemu/blob/master/examples/pepyemu.py. It looks like load method is not implemented. Based on example usage it's required to load PE file ...
malikcjm's user avatar
  • 364
1 vote
Accepted

Dose PE Explorer unpack upx executables?

The product overview of PE Explorer states in several places that it will load PE files that are compressed with UPX. Open UPX-, Upack- and NsPack-compressed files seamlessly in PE Explorer, ...
Oliver Salzburg's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible