Flag: Tornado! Hurricane!


Packer Name Packer Author Classification Analysis By Last Updated
UPX Crypt archphase (NWC) UPX Modifier quig May 1 2005
Allocation Anti-Debug Anti-Disassembly Section Name Sample
PE Header (UPX) yes yes .nwc (default) N/A
Notes
modified upx packed exe

adds new section with variable section name to exe for decode stub

uses a variable passkey for encryption

offsets align with sample

Transfer Command
jmp esi
Entry Point Signature
00407000 > BF 30544000      MOV EDI,in.00405430       ;this block is entire decode loop
00407005   81FF D0554000    CMP EDI,in.004055D0
0040700B   74 10            JE SHORT in.0040701D
0040700D   812F 0B000000    SUB DWORD PTR DS:[EDI],0B
00407013   83C7 04          ADD EDI,4
00407016   BB 05704000      MOV EBX,in.00407005
0040701B   FFE3             JMP EBX
0040701D   BE 30544000      MOV ESI,in.00405430
00407022  -FFE6             JMP ESI                   ;esi=405430  end of decode loop                         

00405430   ? 60             PUSHAD               ;start of regular upx stub
00405431   ? BE 00504000    MOV ESI,in.00405000
00405436   . 8DBE 00C0FFFF  LEA EDI,DWORD PTR DS:[ESI+FFFFC000]
0040543C   . 57             PUSH EDI
0040543D   . 83CD FF        OR EBP,FFFFFFFF
00405440   . EB 10          JMP SHORT in.00405452
00405442     90             NOP
00405443     90             NOP
00405444     90             NOP
00405445     90             NOP
00405446     90             NOP
00405447     90             NOP
Known Unpackers

There are 29,884 total registered users.


Recently Created Topics
Incorrect bitness wh...
May/20
PaiMei stalker modul...
May/19
Attach to program us...
May/13
IDA PRO how to make ...
May/12
FACT: OpenRCE is dead.
May/08
Int 3 anti debug?
May/05
help needed - Beginn...
May/03
Attaching IDA Pro to...
Apr/27
File type
Apr/21
Debugging iphone app...
Apr/15


Recent Forum Posts
Debugging iphone app...
staree2010
Ollydbg 2.0 - Plugin...
openrce...
IDA PRO how to make ...
codeinject
FACT: OpenRCE is dead.
codeinject
IDA Resource Viewer ...
r2x64
FACT: OpenRCE is dead.
djnemo
FACT: OpenRCE is dead.
codeinject
FACT: OpenRCE is dead.
pedram
help needed - Beginn...
araujo
Attaching IDA Pro to...
codeinject


Recent Blog Entries
sweetyss
May/18
Adam Wainwright continues t...

lowpriority
Apr/13
OllyMigrate Plugin for Olly...

everdox
Mar/08
2 anti-trace mechanisms spe...

everdox
Mar/07
Advanced debugging techniques

everdox
Mar/06
Branch tracing and LBR acce...

More ...


Recent Blog Comments
clarisonic on:
Apr/03
New version of Ollydbg!

clarisonic on:
Apr/03
New version of Ollydbg!

trackerx90 on:
Mar/04
SuppressDebugMsg As Anti-De...

coachfactory on:
Feb/25
Portable Executable Format ...

coachfactory on:
Feb/25
A new Anti-Olly trick.

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit