Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 07-02-2006, 04:33
noltia
 
Posts: n/a
UPX Unpacking Issues

I'm trying to unpack two different versions of an application to find out how it generates checksums for the packets it sends.

The packing is identified as UPX by PEID.
The unpacking proccess only runs properly when the isDebuggerPresent flag is modified/hidden, so it may not actually be UPX.

Anyway. I set memory access break point at the "code" section and the first line of code it breaks on is a call to LoadLibraryA, so I continue past a few security checks and it jumps into the OEP.

At this point, I dumped it using Ollydump and Imprec can be used to fix the tables.

It worked fine on the first version, but it *didn't* work properly on the second. So I'm not sure what I'm doing wrong.

In the latter version's dump, most of the imports show as YES (Valid) in Imprec, but there are three imports that show NO (Invalid).

If I try trace level 1, they point to some Kernel import, but the resulting fixed dump does not run.

The first version's dump on the other hand has all Valid (YES) imports and it runs/executes perfectly after being unpacked. The three "invalid" imports are there but they are marked as Valid.

How can I resolve the three invalid pointers in the later version? Any help would be appreciated.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
64bit Programming and Assembly Issues moro3391 x64 OS 1 01-18-2013 18:35
Anti-Piracy Company Issues $40k Hacker Challenge elephant General Discussion 9 02-24-2007 06:33
Syser Debugger 1.1 testing versions issues [ attention ] rockwu General Discussion 4 08-23-2005 18:09


All times are GMT +8. The time now is 17:50.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )