PEiD and UPX
 

Hi,
I have an exe file idents as UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo by PEiD, but when I try to use UPX 1.93 to unpack it, I got the below result:

Is it modified really and how do I get packer exactly? :confused:

Maybe That is Scrambled UPX File. or used Faked UPX Singature
Try Unpacker for UPX Plugins for PEiD in 80% of Cases it will work

otherwise you should attach the file

With UPX, we can use PE Explorer. The UPX plugin of PE Explorer is great, it can unpack all most UPX (scramble, modified) file. Open your exe with PE Explorer and save to new exe. This way is fastest.

Asus
Use Upx Ripper 1.3
http://www.hanzify.org/?Go=Show::List&ID=5441&Down=1&L=cn
or attach file.

upx is not a difficult packer, you can unpack it by hand with little effort and there are a lot of tuts to guide you

and there are some scripts for ollydebug

Thanks to all who replied and give me idea! But I used PEiD to unpack it, it seems successed, but when I run that file, I got the box with:

Application Error
----------------------
The application failed to initialize properly (0xc0000005). Click on OK to terminate the application.

Any suggestion?

tnx.

IAT rebuilding error, use IMPREC to fix it.(get some tuts before)

Thanks for your reply - tao. I will see what I can do;-)

Asus, it's better to give us a download link to help better. :)

WASM seems down so I can not get UPX-Ripper, may anyone attach it?

Asus
/ UPX-Ripper 1.3 in attach /

if it was packed by UPX, it will open into Heaven$oft Resource Tuner and if you save the file it will Unpack with Resource Tuner Embedded UPX Plugins.

Try it also.

Heaven$oft Resource Tuner and PE Explorer is the same plugin
and working sooo nice.. tested by ME..
about ripper not working with all..
PE exploer in our FTP..
thanks Unforgi3n and TQN

Again, thanks to all people who helped me;-) But all of them are failed to unpack files I had in my hand. :confused:

try to analyze your target with RDG Packer Detector! it have better result if your target have fake sign!

I also attached 02 file that identified with UPX by PEiD. Please help me.

They are both certainly UPX'D, do it manually, open them in ollydbg, and scroll down to the

POPAD
JMP ADDRESS

they are right at the bottom, just before all the 0's (not the bottom, bottom, but i mean the bottom of the code you see)

Break on the JMP ADDRESS, and step into the oep, then dump from here, and rebuild the iat.