Re: UPX issues in virus analysis

Hi!

>I'm not sure I've found the right list, but here we go...
The file probably have been packed with upx, and then a tool such as upx scrambler or something like has been
applied..
To work around it , you have to trace the protected file until you find the OEP (Original Entry Point) of the program, then you can dump the process. Its important to dump the process AT the entry point, and not further if you want a reliable dump.
Finally, you have to modify the PE header , and enter the new Entry point. Hint: LordPE is a nice PE editor. If you do it well, you don't have to work on the import table, the file should be perfectly disassemblable and analyzable. (and runnable :)

If you need further help, feel free to email me.

Best Regards,

--
Nicolas Brulez


---------------------------------------------------------------------------
----------------------------------------------------------------------------