![]() |
|
#3
|
|||
|
|||
|
it cant be upx due he doesnt have any antidebug, also doesnt destroy iat, exe is perfectly 100% same as unpacked only unneded things are striped, so rdata where iat is, is same as in not packed version. so check better. maybe its some upx scrambler etc. you can recognize upx by section names and UPX! and ver 2.01 or other, some people remove names and ver to fool you. like curerom
but use cfe to change section name to UPX0 UPX1 and add in winhex 2.00 UPX! and upx -d unpacks perfectly. you can also recognize upx by his EP code like this 00982950 > 60 PUSHAD 00982951 BE 00407B00 MOV ESI,MPC.007B4000 00982956 8DBE 00D0C4FF LEA EDI,DWORD PTR DS:[ESI+FFC4D000] 0098295C 57 PUSH EDI ; ntdll.7C910738 0098295D 83CD FF OR EBP,FFFFFFFF 00982960 EB 10 JMP SHORT MPC.00982972 |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| 64bit Programming and Assembly Issues | moro3391 | x64 OS | 1 | 01-18-2013 18:35 |
| Anti-Piracy Company Issues $40k Hacker Challenge | elephant | General Discussion | 9 | 02-24-2007 06:33 |
| Syser Debugger 1.1 testing versions issues [ attention ] | rockwu | General Discussion | 4 | 08-23-2005 18:09 |