Log in

View Full Version : Unpack UPX


servicenick
February 6th, 2006, 17:45
Hi all,
I unpacked a upx packed proggy with upx -d , it seems it worked well, I can access all the resource and the strings with a debugger or resource editor, but the program doesn't run anymore.

I tried to figure out what went wrong with ollydbg, but I'm a newbie ...
The proggy is KlaimSMS you can google for it or ask me, I'll be glad to send you a copy. It's a freeware prog, I'm trying to reverse it, not crack it.

Bye
Thank you in advance for support

arjuns
February 7th, 2006, 00:11
I think, there is problem with Import Table,Try unpacking using olly and use plugin ollydump because I'd a problem with ImportRec While rebuilding Import table.Finlly you are done..........

kind regards
arjuns..........

servicenick
February 7th, 2006, 04:58
Shouldn't "upx -d" work better (when it works) than ollydump? With IDA I can access all the imported functions in the unpacked prog, It doesn't look like it has a wrong import table. If I run the program simply nothing happens, no errors, but the program terminates.

Anyway, I tried both ways upx -d and ollydump.
I found OEP and I dumped the process with ollydump, but how how do I rebuild Import table?
Is there some suitable tool?

Thank you.

arjuns
February 7th, 2006, 06:30
just check on the Rebuid Import.

servicenick
February 7th, 2006, 18:36
done, nothing to do, the import table is ok, but the prog doesn't work.!

Please help!
Maybe some protection from the author ? ( but it's a freeware prog)

Could you take a look to the program?
You can find KlaimSMS 1.55 beta at http://www.klaimsoft.com/ ("http://www.klaimsoft.com/")

bye
thanks

arjuns
February 8th, 2006, 00:31
Couldn't found it , Can you please send exct link?

servicenick
February 9th, 2006, 16:10
OK, here you are!
Exact link:
http://www.klaimsoft.com/klaimsms/klaimsms.exe ("http://www.klaimsoft.com/klaimsms/klaimsms.exe")

servicenick
February 11th, 2006, 03:20
Dear arjuns, I'm still stuck with this problem,
did you understand something about the program?

Bye