Binary Analysis
upx is not working, why? Nov 22 2005 02:23AM
mao0524 hotmail com (1 replies)
Re: upx is not working, why? Nov 23 2005 01:08AM
Chris Eagle (cseagle redshift com)
mao0524 (at) hotmail (dot) com [email concealed] wrote:
> File size Ratio Format Name
> -------------------- ------ ----------- -----------
> upx: ./list/services.exe: CantUnpackException: file is
modified/hacked/protected
> ; take care!!!
>
> Unpacked 0 files.
>
> -----------------------------------------
>
> What's the matter?
>
>

There are any number of tools out there that corrupt the UPX file
headers in order to prevent the file from being unpacked with upx.
Usually some minor tweaks with a hex editor will set things straight.
If you don't want to use a hex editor, then load the file up in OllyDbg
and set a break point at the jmp instruction immediately following the
popa at roughly start+0x14E run to the breakpoint and dump memory.

Chris

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus