📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Decompress Kkrunchy Executables

Topic created on: April 26, 2008 11:34 CDT by eamous .

Hey guys,
While trying to reverse a potential malware, I came across a problem that the executable file is compressed.
By looking at the code segment I was able to identify that the executable file was compressed using kkrunchy: http://www.farbrausch.de/~fg/kkrunchy/
Is anyone aware of any tool that can DECOMPRESS kkrunchy executables?

Thanks in advance,
Essa Amous.

  nezumi     April 27, 2008 00:13.23 CDT
which version of kkrunchy? firsts ones were based on UPX (if I remember this correctly), but the newers were rewritten.
anyway: universal unpacker QuickUnpack unpacks kkrunchy very well. btw, kkrunchy is a small packer, so it's easy to unpack it manually. anyway, take this link: http://azmoaore.wordpress.com/2007/03/16/unpacking-tutorials-links/. I hope, it'll help you.

years ago I wrote an article how to unpack packed/protected EXE/DLL/ELF files under NT/Linux with your own hand and a few simple tools. it's quite obsolete now (I mean: the article), I'm going to update and publish it here (if admin don't mind) or upload the old version to collect your requests :-)

  eamous     April 27, 2008 04:18.16 CDT
> nezumi: which version of kkrunchy? firsts ones were based on UPX (if I remember this correctly), but the newers were rewritten.
> anyway: universal unpacker QuickUnpack unpacks kkrunchy very well. btw, kkrunchy is a small packer, so it\'s easy to unpack it manually. anyway, take this link: http://azmoaore.wordpress.com/2007/03/16/unpacking-tutorials-links/. I hope, it\'ll help you.
>
> years ago I wrote an article how to unpack packed/protected EXE/DLL/ELF files under NT/Linux with your own hand and a few simple tools. it\'s quite obsolete now (I mean: the article), I\'m going to update and publish it here (if admin don\'t mind) or upload the old version to collect your requests :-)

Thanks Nezumi,
Yes, you're correct, it was easier to unpack it manually although it took me some time to find the OEP and fix the IAT :)
I�ll try and look for the QuickUnpack for next time.
Btw, I tried to access the tutorials http://azmoaore.wordpress.com/2007/03/16/unpacking-tutorials-links/ but it seems they�re not available anymore :S
Anyways, appreciate your help.

Cheers,
Essa Amous.

  rakish     April 27, 2008 05:06.47 CDT
...
> Btw, I tried to access the tutorials http://azmoaore.wordpress.com/2007/03/16/unpacking-tutorials-links/ but it seems they�re not available anymore :S
...

the tutorials:

http://azmoaore.reversedcode.com/rce-tutorials/
...
Unpacking Kkrunchy 0.23 (Arabic)
...

  r0main     April 27, 2008 10:53.38 CDT
An unpacker for kkrunchy (with source code) is also available here: http://reverseengineering.online.fr/spip/spip.php?article96 (French)

  shiki     April 28, 2008 05:07.58 CDT
IIRC latest version of kkrunchy (last time i looked which was a while back!) was using a PAQ-type compression algorithm - i.e. based on neural-network context mixing and arithmetic coding. Reversing it is reasonably easy, especially if keeping one eyeball on source codes from http://www.cs.fit.edu/~mmahoney/compression/
There are some pre-transformation applied to code before compression tho (and not just converting relative offsets of jumps/calls). Manual unpacking is trivial, but it's not meant to be a protector! ;) Nice algo but the packer's unreliable as hell :(

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit