BRAT in .data, .text....

[AarzaK]

Hi, sorry my question. I "unpacking" a .exe with upx, now says this BRAT in all sections.

How I can Solved this? now says BRAT

what is BRAT?

Sorry my English.

Regards.

[CoDe_InSiDe]

Hi AarzaK,

I believe BRAT is the author of the tool you used to unpack UPX :)
He puts his name in the sections because you used that unpacking tool ;)
You can simply change the sections names in whatever you want.

Regards,

CoDe_InSiDe

[AarzaK]

HI CoDe_InSiDe;



Object table:



# *Name * VirtSize * * RVA * * *PhysSize *Phys off *Flags

__________________________________________________ ________________

01 UPX0 * 00133000 * 00001000 * 00000000 *00000400 E0000080 [UERW]

02 UPX1 * 000A3000 * 00134000 * 000A2A00 *00000400 E0000040 [IERW]

03 .rsrc *00002000 * 001D7000 * 00001C00 *000A2E00 C0000040 [IRW]







later, I use Unpacker (Upx)





examply no remember the REAL VirtSize,RVA,PhysSize,Phys off and *Flags.



# *Name * VirtSize * * RVA * * *PhysSize *Phys off *Flags

__________________________________________________ ________________

01 BRAT * 00000000 * 00000000 * 00000000 *00000000 00000000 [UERW]

02 BRAT * 00000000 * 00000000 * 00000000 *00000000 00000000 [IERW]

03 BRAT * 00000000 * 00000000 * 00000000 *00000000 00000000 [IRW]




and OllyDbg equal says:

"code encryted or compress ........bla,bla,bla"
and cannot open the .exe fine

this is my problem who I can solve this??

I no have Experience in compressed/packed/encripted .exe :(

Best Regards!

[zyzygy]

hi ,

you could use the unpacker in proc-dump or upx itself .i think the unpacker you are using seems to has goofed up with the exe.

zyzygy

[AarzaK]

Problem->Solved

I use the upx, c:upx -d programname.exe


:D