Menu

1 / 25

UPX Packed Headaches

Akamai·Akamai SIRT·6 months ago
#ni2Xptsq
#binary#unpacked#headers#tool#photo
Reading 0:00
15s threshold

Researching malware has many challenges.  One of those challenges is obfuscated code and intentionally corrupted binaries. To address challenges like this, we've written a small tool in C that could fix intentionally corrupted binaries automatically. We also plan to open-source the project so other researchers could use it too, and perhaps improve and expand upon the tool's capabilities as needed.

\r\n Intentionally corrupted

\r\n An example of this scheme entails packing a binary with the UPX packer and modifying key fields in the file's UPX header -  typically the file size.

\r\n These modifications will allow the binary to run without problems if executed, but typically cause the UPX unpacking utility to throw errors and be unable to unpack the "mangled" binary.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.