unUPX v1.06
A Manual Unpacking Essay!
Written by McCodEMaN
Introduction |
Tools required |
Target's URL |
My target was notepad.exe
Essay |
Don't mind the addresses!
Open up the packed target in SoftIce symbol loader.
Yes...you're absolutely right, softice won't break! OK, lets fix this minor problem....
Run ProcDump and open the target with the PE Editor, then click Sections. Edit UPX0 section and change:
E0000080 into: E0000060
Now, when you load the file you'll end up here......
:0040F9F0 60
PUSHAD <--Push registers to stack!
:0040F9F1 BEAEC04000
MOV ESI, 0040C0AE <--Start!
:0040F9F6 8DBE524FFFF
LEA EDI, [ESI+FFFF4F52]
:0040F9FC 57
PUSH EDI
:0040F9FD 83CDFF
OR EBP, -01
:0040FA00 EB10
JMP 0040FA12
If we keep on tracing down through the code we'll loop...loop...loop and so on!
So, here is what we'll do.....
Scroll down the window until you see this:
:0040FB31 8903
MOV [EBX], EAX
:0040FB33 83C304
ADD EBX, 04
:0040FB36 EBE1
JMP 0040FB19
:0040FB38 FF96ACFC0000
CALL [ESI+0000FCAC]
:0040FB3E 61
POPAD <---Bpx
here!
:0040FB3F E98815FFFF
JMP 004010CC <--Jump to
entry point!
:0040FB44 0000
ADD [EAX], AL
:0040FB46 0000
ADD [EAX], AL
:0040FB48 0000
ADD [EAX], AL
Set a bpx on POPAD and press F5!
When softice breaks again go down to the JMP after POPAD and write down the entry point.
The PE Entry point that you'll need later on is: JMP 004010CC -
400000 (ImageBase) = 10CC (In this case).
Now create a infinite loop, like this:
a eip [ENTER] and jmp eip [ENTER] and [Esc]!
Clear your breakpoint and leave softice (F5).
Run ProcDump and set options like this:
Under Structure:
-Recompute Object Size
-Optimize PE Structure (If you like to see Imports and Refs in W32Dasm, don't check this option!)
Under Import:
-Rebuild new import table
You can now select your task and make a full dump, then name it and save.
Run the PE Editor and open your dumped file, then enter the correct PE Entry point (10CC).
Final Notes |