URL: https://youtu.be/guOcU-ZTL3A
In today’s video I’ve quickly manually unpacked UPX-packed .exe in a debugger
I’ve used x32/x64dbg for it and i did the following:
- Open .exe in a debugger, open graph view (G)
- Notice there isnt many functions, doubleclick to the first call
- You’ll notice that there is a lot more functions now, looking all the way down we can see a huge function – before it there should be a jump in the function before -that jump is jumping to an adress far way – its called a tail jump
- Breakpoint (BP) on that jump, run until the program hits it. After that jump executes we’ll be able to see all the code within the long function change – but we have to click JUMP INTO, not just run – that way we’ll enter that part of the code
- Once we are in you’ll notice that not all the lines look the same – like they did in the graph view -but instead they changed to actual assembly code.
- At the start of the code (usually) copy the mem address – open Scylla
- Paste it into the first field at the bottom left – press IAT Autosearch and then Get imports
- After that press dump – save that to a file – then press “Fix dump” and select the file you just dumped
- That will create a file with SCY in the name – that file should be dumped good.
- It should have IATs fixed.
- After you compare the unpacked and packed version in ghidra you’ll quickly realize why we did this 🙂
Note: you gotta search for undefined functions as well in ghidra – dont forget. Not perfect, i know – but not far from it either 🙂
Thank you for reading!
**Disclaimer: this video is for educational purposes, these softwares are purposely created for patching. Nothing in this video is meant to be used illegally, nor promote anything like that. All of my videos are in isolated environments and the goal is to teach better cybersec – both in red and blue teams.**
