Flag: Tornado! Hurricane!


Packer Name Packer Author Classification Analysis By Last Updated
UPX Crypt archphase (NWC) UPX Modifier quig May 1 2005
Allocation Anti-Debug Anti-Disassembly Section Name Sample
PE Header (UPX) yes yes .nwc (default) N/A
Notes
modified upx packed exe

adds new section with variable section name to exe for decode stub

uses a variable passkey for encryption

offsets align with sample

Transfer Command
jmp esi
Entry Point Signature
00407000 > BF 30544000      MOV EDI,in.00405430       ;this block is entire decode loop
00407005   81FF D0554000    CMP EDI,in.004055D0
0040700B   74 10            JE SHORT in.0040701D
0040700D   812F 0B000000    SUB DWORD PTR DS:[EDI],0B
00407013   83C7 04          ADD EDI,4
00407016   BB 05704000      MOV EBX,in.00407005
0040701B   FFE3             JMP EBX
0040701D   BE 30544000      MOV ESI,in.00405430
00407022  -FFE6             JMP ESI                   ;esi=405430  end of decode loop                         

00405430   ? 60             PUSHAD               ;start of regular upx stub
00405431   ? BE 00504000    MOV ESI,in.00405000
00405436   . 8DBE 00C0FFFF  LEA EDI,DWORD PTR DS:[ESI+FFFFC000]
0040543C   . 57             PUSH EDI
0040543D   . 83CD FF        OR EBP,FFFFFFFF
00405440   . EB 10          JMP SHORT in.00405452
00405442     90             NOP
00405443     90             NOP
00405444     90             NOP
00405445     90             NOP
00405446     90             NOP
00405447     90             NOP
Known Unpackers
Active in Last 5 Minutes
excavationfondations
bigines

There are 21,678 total registered users.


Recently Created Topics
PyEmu error when cal...
Sep/02
Restore Themida/Winl...
Sep/02
Anti-olly technique
Aug/30
RAR Password
Aug/29
Heap protection on W...
Aug/23
Why Inline asm in C+...
Aug/20
Bypassing OllyAdvance
Aug/17
Error in logic for g...
Aug/17
Has anyone seen this...
Aug/17
ARM Executable - Pat...
Aug/16


Recent Forum Posts
reverse engineering ...
raiden56
pydbg, memory breakp...
Researc...
RAR Password
Ineedhelp
RAR Password
cod
Heap protection on W...
voila
Heap protection on W...
j00ru
Heap protection on W...
voila
Heap protection on W...
j00ru
Heap protection on W...
psylocn
Why Inline asm in C+...
ronnie2...


Recent Blog Entries
meshmesh
Sep/01
Is it legal??

waleedassar
Aug/30
Anti-olly technique

QvasiModo
Aug/24
WinAppDbg 1.4 is out!

artemblagodarenko
Aug/18
Dataflow-0.2.0 released. Ne...

grzonu
Aug/17
Bypassing OllyAdvanced

More ...


Recent Blog Comments
tosanjay on:
Sep/02
PyEmu 0.0.2

GynvaelColdwind on:
Sep/01
Is it legal??

PeterFerrie on:
Aug/31
Anti-olly technique

dennis on:
Aug/26
Dr. Gadget IDAPython plugin

halsten on:
Aug/19
Dataflow-0.2.0 released. Ne...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit