![]() |
|
#1
|
|||
|
|||
|
UPX Unpacking Issues
I'm trying to unpack two different versions of an application to find out how it generates checksums for the packets it sends.
The packing is identified as UPX by PEID. The unpacking proccess only runs properly when the isDebuggerPresent flag is modified/hidden, so it may not actually be UPX. Anyway. I set memory access break point at the "code" section and the first line of code it breaks on is a call to LoadLibraryA, so I continue past a few security checks and it jumps into the OEP. At this point, I dumped it using Ollydump and Imprec can be used to fix the tables. It worked fine on the first version, but it *didn't* work properly on the second. So I'm not sure what I'm doing wrong. In the latter version's dump, most of the imports show as YES (Valid) in Imprec, but there are three imports that show NO (Invalid). If I try trace level 1, they point to some Kernel import, but the resulting fixed dump does not run. The first version's dump on the other hand has all Valid (YES) imports and it runs/executes perfectly after being unpacked. The three "invalid" imports are there but they are marked as Valid. How can I resolve the three invalid pointers in the later version? Any help would be appreciated. |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| 64bit Programming and Assembly Issues | moro3391 | x64 OS | 1 | 01-18-2013 18:35 |
| Anti-Piracy Company Issues $40k Hacker Challenge | elephant | General Discussion | 9 | 02-24-2007 06:33 |
| Syser Debugger 1.1 testing versions issues [ attention ] | rockwu | General Discussion | 4 | 08-23-2005 18:09 |