Hi Guys,

hv read some where that it is possible unpacking UPX file on debuggin session with OLLY is that correct ? if yes how ?

rgds

Melvill

yes it's correct. Just search for the famous signature bytes, breakpoint, run, dump. Job done

the plugin ollydmp is useful, and have a tracer to help find the OEP to dump.

Ricardo

Hello Ricardo
Can you write a tut about how to use ollydmp please?

regards

i write many tuts and i have a tut how unpack upx with ollydmp but is not translated is in spanish and for XP.

Ricardo

Thks Guys

Ricardo, can you send this tut for me ? i understand Spanish

melvill@crkportugal.com

thnks

loooool

And what about us?
I don't understand Spanish lng.

Why do you need a tut for UPX? It's by far the easiest packer to unpack !

I don't need a tut for UPX ,I need a tut about how to use OllyDmp only.

If you don't understand spanish, use Babelfish.

Also, I find LordPE better than OllyDump.

LordPE is different OLLYDMP.

If you dump with ollydmp and rebuild with lordpe, ollydmp try reconstruct the IAT, the 90 % of unpackings in UPX, rebuild perfect IAT, with lordpe is a good dumper but no rebuild THE IAT, the dumped run only in your machine if run, and you need use IMPORT RECONSTRUCTOR or REVIRGIN, with OLLYDMP is not necesary, make all the work.

Ricardo

Ricardo Narvaja, can you send me the tut for unpack UPX in Ollydbg?
ps: I can read spanish well!

robmad@hotmail.com

Thanks!!!

Yah send me too please :P

I understand spanish TOO (babelfish even)

Thanks

TByteSoft@ntlworld.com

http://www.geocities.com/r_etarded/ollydump.html
("http://www.geocities.com/r_etarded/ollydump.html
")

a tute to unpack with olly/ollydump for UPX/FSG

Checkout GuiPEX. A program that is make to both uncompress/compress programs. Works like a charm.

I am a noob to unpacking. I followed the tutorial above and unpacked the exe.
But when i load the unpacked exe in Olly, Olly says that the Entry Point is outside the code as specified in the PE Header. So i can't set breakpoints very well. Is this ok? If not, how can i correct the PE Header in this example tutorial? Sorry for my bad english Thanks.

Change the flags of the section containing the real entry point to executable, and then ensure that the Baseofcode and Baseofdata pointers in the PE header are correct.

Is not a truoble this, in a pecked program this cartel always appear, and in a unpacked program too, is not important don't worry and continue.

Ricardo