PDA

View Full Version : How can I learn to make an auto unpacking script for programs I have unpacked


PimpDawg
June 24th, 2010, 16:01
Is there any documentation on memory mapping to unpack programs and making packers? Specifically, what would I have to look into for this? Memory mapping?

FrankRizzo
June 24th, 2010, 18:30
Well, as with any programming project, enumerate the tasks that you want to accomplish, and then break those down into chunks. Then, use google for each chunk, and you should be moving along.

anom
June 24th, 2010, 19:32
There are various approaches on how to automate the task of unpacking. We got ODbgScript for example, allowing fast assembly-like scripting.

Then, there are frameworks usable with various programming and scripting languages. You can either let your unpacker act as a debugger or inject some code into the target that hooks into some points useful for unpacking it...

Tons of methods, all depending on your personal liking and/or programming/scripting experience.

arebc
June 25th, 2010, 10:40
Quote:
[Originally Posted by PimpDawg;86987]Is there any documentation on memory mapping to unpack programs and making packers? Specifically, what would I have to look into for this? Memory mapping?


I don't know if this will help but one possible solution would be to use ollydbg (on a packed file) as an API logger. You could log all the API calls, press play on a packed file, inspect the arguments around VirtualAlloc and other "memory mapping" APIs, then set BPs on interesting APIs, restart and then inspect the code to get a better understanding of the packer. To use Ollydbg as an api logger right click > search for > All Intermodular Calls > right click on the calls > Set Log Breakpoint on every command > Select option to Log Value of expression on Condition