📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Malware: Extracting SFX (.exe) from Linux

Topic created on: February 2, 2007 10:20 CST by DennisRand .

I'm looking at reversing different types of malware and now I've come to Malware that are packed with SFX from either WinRAR or WinZIP, is it possible to extract these .exe files from Linux.

I'm running on a Soekris box with Debian, and there are NO XWindows installed so it has to be done from commandline.

Looking forward into hearing from you.

Best regards
Dennis Rand

  aeppert     February 2, 2007 10:53.45 CST
While, this might be the answer you are after...here it is.

Generally the original compressed archive is tucked away past the extraction code.  Thus, what I would recommend is searching for the magic bytes (RAR being "Rar!", and PkZip being PK\003\004) and begin extracting the archive from there.

You should be able to throw together a quick Python or Perl script to accomplish this in a few minutes.

  anonymouse     February 2, 2007 11:01.39 CST
you mean you have somefile.exe which is a winrar sfx and you want to extract this sfx in linux

use unrar

a quick sample

masm32 9x installation zip is a winrar sfx

unzip legacy.zip
ls
legacy.zip
leagcy.exe
file legacy.exe
legacy.exe: MS_DOS Executable (EXE), os/2 or mswindows

unrar t -v legacy.exe

unrar 3.40 beta 5 freeware copyright (c) ar
testing archieve legacy.exe
title = blah blah
text == blah blah
note: blah blah

testing com/docs/accessing com objects from assembly.doc
and so on

you can extract them with unrar e legacy.exe

hope this is what you were meaning

  DennisRand     February 2, 2007 11:30.22 CST
Unrar is handled now but I still have a bit of problems with unzip:

phonehome:/opt/malware/bin# unzip cartao.scr
Archive:  cartao.scr
  End-of-central-directory signature not found.  Either this file is not
  a zipfile, or it constitutes one disk of a multi-part archive.  In the
  latter case the central directory and zipfile comment will be found on
  the last disk(s) of this archive.

  PSUJobu     February 2, 2007 11:46.22 CST
> DennisRand:
> phonehome:/opt/malware/bin# unzip cartao.scr
> Archive:  cartao.scr
>   End-of-central-directory signature not found.  Either this file is not
>   a zipfile, or it constitutes one disk of a multi-part archive.  In the
>   latter case the central directory and zipfile comment will be found on
>   the last disk(s) of this archive.

Was this after following Aaron's advice? If not, for this one instance you could just find the offset of the "PK\003\004" signature using a hex editor and then use 'tail' with output redirection to get a ZIP file (most likely with trailing junk, but unzip will ignore that).

If you're going to do this a lot, a Python or Perl script is a good idea...

  DennisRand     February 2, 2007 13:37.01 CST
Thanks :) Problem solved

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit