New 2 Cracking
~~~~~~~~~~~~~~

Tutorial Type  : Essay
Tutorial Topic : UPX Manual Unpacking and MORE
Written by     : ParaBytes
Utilities      : PE Editor/Debugger/W32Dasm/UPX/Notepad (supplied with Windows)/Hex Editor/IceDUMP/ReVirgin
Music          : Soft Rock, i'll never fall in love again / elvis costelo (other stuff like that can be good as well)
Date           : Feb. 11th, 2002.
Remarks        : You can use whatever debugger you like, i'll use SoftICE
                 Utilities can be found in www.exetools.com


Let's rave ! :-) 

lets 1st understand how the packed programs are working,

start the program
unpacking loop
jump oep

now, oep is the Original Entry Point, 
its the place where the original program starts in its code.
UPX can unpack it self with upx -d packed.exe
it will restore the almost original exe.
so try it 1st,
if not working, go and try the manual unpacking.

pack notepad with UPX, (every windows version can have little different version of notepad, so the offsets might be changed..)
upx -9 -o packed.exe notepad.exe
upx, compress better, output will be packed.exe, pack notepad.exe

not bad, 58.6kb > 18.kb
pretty good even...

now, open the packed.exe in W32Dasm,
click on 'end' button
do you see at the buttom of the code

:0040E94E 61                      popad
:0040E94F E98827FFFF              jmp 004010DC <--- that the oep, maybe changed a bit...

but wait, that not the oep, 
to get the oep, you need to substruct 004010DC the image base,
the image base can be found in the start of the W32Dasm


Disassembly of File: PACKED.EXE
Code Offset = 00000200, Code Size = 00000000
Data Offset = 00000200, Data Size = 00000000

Number of Objects = 0003 (dec), Imagebase = 00400000h     <------ image base

   Object01: UPX0     RVA: 00001000 Offset: 00000200 Size: 00000000 Flags: E0000080
   Object02: UPX1     RVA: 0000B000 Offset: 00000200 Size: 00003A00 Flags: E0000040
   Object03: .rsrc    RVA: 0000F000 Offset: 00003C00 Size: 00000E00 Flags: C0000040

so the oep is 10DC, write down that number.

now, 
lets goto the end of file, back to the popad
we need the file to stop running there,
and keep itself on the same place...
so,
change the code of the jmp OEP (E98827FFFF)
to EBFE.
EBFE means :
jmp to the same place you are right now.
that will goto endless loop that will keep the file in the place we want.
run the file,
wait a second, even two,
goto SoftICE, check, the place is the same offset we need ?
yes. it is,
e eip  (edit data, on eip, that mean, hex edit the code)
E988 (our old codes)
enter (go back to softice)
go into the jmp,
in the 1st instrucion you are (the OEP)
do
/pedump 00400000 eip dumped.exe (dumping the process)
exit softice

open PE Editor, select dumped.exe
and in the Entry Point write the OEP we have, 000010DC
and close.
now you have unpacked, working file.
though, the file is unpacked, it wont ever be like the original one.
open dumped.exe in W32Dasm,
no imports ? all the strings went crazy ???
ohh no !
so, lets fix the Imports,
open the packed.exe
run revirgin
selected the packed.exe,
enter the OEP,
Resolve IAT,
select dumped.exe
and exit the revirgin,
re-disassemble dumped.exe,
excellent !
all works, the strings are good as well.


Patching Through UPX
~~~~~~~~~~~~~~~~~~~~
ok, we have the unpacked file, fixed,
its 68KB, 'lil bigger than the original one..
but, we dont care...
lets patch it to not ask is if we want open the file in wordpad, make it do it automaticlly !
lets go in the dumped.exe and check for the string wordpad.exe

we see it only once.
scroll up,

* Possible Reference to String Resource ID=00036: "&f"
                                  |
:00403082 6A24                    push 00000024
:00403084 A1B0504000              mov eax, dword ptr [004050B0]
:00403089 56                      push esi                          // push MessageBox Parameters
:0040308A 50                      push eax
:0040308B FF7508                  push [ebp+08]

* Reference To: USER32.MessageBoxA, Ord:01AEh
                                  |   
:0040308E FF15B8644000            Call dword ptr [004064B8]         // MessageBoxA
:00403094 83F806                  cmp eax, 00000006                 // answered yes ?
:00403097 0F85A7000000            jne 00403144                      // if not, go to 0043144
:0040309D 6804010000              push 00000104                     // if do,
:004030A2 8D858CFDFFFF            lea eax, dword ptr [ebp+FFFFFD8C] // start the process
:004030A8 837D1001                cmp dword ptr [ebp+10], 00000001  // of loading the file
:004030AC 1BFF                    sbb edi, edi                      // into wordpad.exe
:004030AE 50                      push eax
:004030AF 83C737                  add edi, 00000037

* Possible Reference to String Resource ID=00056: "wordpad.exe"
                                  |
:004030B2 6A38                    push 00000038
:004030B4 FF35F0544000            push dword ptr [004054F0]

* Reference To: USER32.LoadStringA, Ord:01A0h
                                  |
:004030BA FF1510644000            Call dword ptr [00406410]

so, to make the file auto-wordpad, we need to
make the messagebox disappear, and the code jump from the start of pushing to he part its starting the load
to Wordpad,
that mean, make the offset 00403089 do EB15
that means, jmp 15 bytes forward to 0040309D 
so, we need to patch it THROUGH the UPX,
what we do ?

as you know, the packed file doing

start the program
unpacking loop
jump oep

so, if before its jumping to the oep, we change the data in the offsets we need ?
it might work ! (its better work, else, i'll kick it in the stack !)

so, start Hiew,
open the packed file, goto the part where its doing jmp 004010DC (0040E94F)
and change the code so it will

mov b,[00403089],0EB (you need 0, because its cant compile the hex number that start with a letter)
mov b,[0040308A],15  (and the b,[address] says, byte)
push 004010DC
ret

update the file,
run the patched file,
open a big text file,
WOW!
excellent job.

Ending :
~~~~~~~~

I hope you learnt something today,
the idea of manually unpacking files is same for all packers,
but its not the same method of finding the OEP in all of them,
same with patching. same with all, but in some, like asprotect (and other) 
you have CRC checking, so you need to fix more things in the file.
and for ending, a quote from ProcDump readme, by G-Rom "If it runs, it can be defeated."

****** ADDED IN THE ZIP FILE THE PATCHED & PACKED NOTEPAD.EXE ******

Greetins :
~~~~~~~~~~

This time the greetings are 'lil different than usually,
i'd like to thanks the ProcDump Group for giving us a great utility,
+Tshep for ReVirgin and the great tutorials publising,
i'd like to thanks the people that made see the truth about the scene and pushed me (while they mean to push me away)
starting a New Crackers University, and also,
New 2 Cracking people, Unpacking Gods people, ThrawN,
krobar, tKC, CoDe InSiDe that teach me things like the inline patching,
and many many more...
and LoopBack :D (if you know what i mean, you'll laugh ;p)

Contact Me :
~~~~~~~~~~~~

E-Mail : Lewsers@Hotmail.Com
IRC    : EFNET / #New2Cracking
Here :)

ParaBytes, Lewsers Inc. 2oo2.