Reverse Engineering Unpacking UPX manually with IDA Pro and Scylla

>> YOUR LINK HERE: ___ http://youtube.com/watch?v=3cQ2G24OVHQ

Reverse Engineering - Unpacking UPX manually with IDA Pro and Scylla • In this video we go through unpacking UPX manually using IDA Pro, Lord PE and Scylla. If you feel like skipping through the video, here are the steps: • Pack a random binary and examine it (Code, Import/Export table) • Locate the jump to the original entry point (OEP) • Set a breakpoint before the jump to the OEP • Take the jump • Dump the process using LordPE, making sure it's a Full Dump • Attach with Scylla (x86 version for 32-bit processes) • Scylla reconstructs import table correctly (Demonstrate this in IDA) • OEP (original entry point) found by Scylla is invalid • Find the correct OEP in IDA Pro • Perform a final dump with the correct OEP • Verify the dumped executable has all the imports reconstructed and runs correctly • Tips • ==== • If the flow chart tool is missing in your IDA distribution, get it from an older version (e.g. IDA v5.1) and then modify ida.cfg file: • GRAPH_VISUALIZER = wingraph32.exe -remove -timelimit 10 • --------------------------------------------------------------------------------------------------- • Follow us on Twitter : / reversinghub • Github : https://github.com/reversinghub • --------------------------------------------------------------------------------------------------- • If you liked this video and you want to learn hands-on how to analyse malware, with real samples and practical exercises, find us on Udemy : • https://www.udemy.com/course/reverse-... • --------------------------------------------------------------------------------------------------- • Want to support us continue to make great content? Buy us a coffee : • https://ko-fi.com/reversinghub • Thank you 🙏

#############################

New on site