|
it cant be upx due he doesnt have any antidebug, also doesnt destroy iat, exe is perfectly 100% same as unpacked only unneded things are striped, so rdata where iat is, is same as in not packed version. so check better. maybe its some upx scrambler etc. you can recognize upx by section names and UPX! and ver 2.01 or other, some people remove names and ver to fool you. like curerom
but use cfe to change section name to UPX0 UPX1 and add in winhex 2.00 UPX! and upx -d unpacks perfectly.
you can also recognize upx by his EP code like this
00982950 > 60 PUSHAD
00982951 BE 00407B00 MOV ESI,MPC.007B4000
00982956 8DBE 00D0C4FF LEA EDI,DWORD PTR DS:[ESI+FFC4D000]
0098295C 57 PUSH EDI ; ntdll.7C910738
0098295D 83CD FF OR EBP,FFFFFFFF
00982960 EB 10 JMP SHORT MPC.00982972
|