Lab 18-1 Solutions
Lab18-01.exe is Lab 14-1 Solutions packed with a
slightly modified version of UPX, one of the most popular packers encountered in the wild. The
modifications to UPX make it more resistant to signature detection. When you run PEiD on the packed
executable, it does not detect the packer. However, a section in the file named UPX2 should make you suspect that a UPX-like packer is being used. Running
UPX –d on the packed file fails because of the
modifications made to the packer.
We first try to unpack the program manually by loading the program in OllyDbg to find the OEP. First, we simply page down through the code to see if the tail jump is obvious. As you can see in Example C-173, it is.
Example C-173. Tail jump for the modified ...
Get Practical Malware Analysis now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
