Flag: Tornado! Hurricane!


Packer Name Packer Author Classification Analysis By Last Updated
UPX Crypt archphase (NWC) UPX Modifier quig May 1 2005
Allocation Anti-Debug Anti-Disassembly Section Name Sample
PE Header (UPX) yes yes .nwc (default) N/A
Notes
modified upx packed exe

adds new section with variable section name to exe for decode stub

uses a variable passkey for encryption

offsets align with sample

Transfer Command
jmp esi
Entry Point Signature
00407000 > BF 30544000      MOV EDI,in.00405430       ;this block is entire decode loop
00407005   81FF D0554000    CMP EDI,in.004055D0
0040700B   74 10            JE SHORT in.0040701D
0040700D   812F 0B000000    SUB DWORD PTR DS:[EDI],0B
00407013   83C7 04          ADD EDI,4
00407016   BB 05704000      MOV EBX,in.00407005
0040701B   FFE3             JMP EBX
0040701D   BE 30544000      MOV ESI,in.00405430
00407022  -FFE6             JMP ESI                   ;esi=405430  end of decode loop                         

00405430   ? 60             PUSHAD               ;start of regular upx stub
00405431   ? BE 00504000    MOV ESI,in.00405000
00405436   . 8DBE 00C0FFFF  LEA EDI,DWORD PTR DS:[ESI+FFFFC000]
0040543C   . 57             PUSH EDI
0040543D   . 83CD FF        OR EBP,FFFFFFFF
00405440   . EB 10          JMP SHORT in.00405452
00405442     90             NOP
00405443     90             NOP
00405444     90             NOP
00405445     90             NOP
00405446     90             NOP
00405447     90             NOP
Known Unpackers
Active in Last 5 Minutes
waleedassar

There are 28,220 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

waleedassar
Jan/01
Another OllyDbg Anti-Debug ...

More ...


Recent Blog Comments
NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

NirIzr on:
Jan/31
Yet Another Anti-Debug Trick

jackchen on:
Jan/10
nike mercurial vapor iii

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit