Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 07-03-2006, 02:39
Human
 
Posts: n/a
it cant be upx due he doesnt have any antidebug, also doesnt destroy iat, exe is perfectly 100% same as unpacked only unneded things are striped, so rdata where iat is, is same as in not packed version. so check better. maybe its some upx scrambler etc. you can recognize upx by section names and UPX! and ver 2.01 or other, some people remove names and ver to fool you. like curerom
but use cfe to change section name to UPX0 UPX1 and add in winhex 2.00 UPX! and upx -d unpacks perfectly.
you can also recognize upx by his EP code like this

00982950 > 60 PUSHAD
00982951 BE 00407B00 MOV ESI,MPC.007B4000
00982956 8DBE 00D0C4FF LEA EDI,DWORD PTR DS:[ESI+FFC4D000]
0098295C 57 PUSH EDI ; ntdll.7C910738
0098295D 83CD FF OR EBP,FFFFFFFF
00982960 EB 10 JMP SHORT MPC.00982972
Reply With Quote
  #2  
Old 07-04-2006, 12:01
noltia
 
Posts: n/a
Thanks for both of your comments, the import address table was invalid because the process makes certain API calls only after modifying the kernel with a driver.

Imprec's level 1 trace worked, but it didn't seem like it was executing because "ExitProcess" gets called after it checks for a device/driver it unpacks and loads into the kernel on runtime.

It is an evil, piece of software.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
64bit Programming and Assembly Issues moro3391 x64 OS 1 01-18-2013 18:35
Anti-Piracy Company Issues $40k Hacker Challenge elephant General Discussion 9 02-24-2007 06:33
Syser Debugger 1.1 testing versions issues [ attention ] rockwu General Discussion 4 08-23-2005 18:09


All times are GMT +8. The time now is 19:44.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )