PDA

View Full Version : UPX scrambled


Moi
02-10-2006, 07:39 PM
Need some help on an upx-ed file. If I load it into ollydbg I get an entry point outside the code error.

It has UPX0,UPX1,UPX2 inside (version 1.08). But it isn't a normal upx because it starts with something that looks like a XOR loop.
I know how to unpack and change the OEP manual but this one is difficult.

Program code starts with:

PUSH 258
POP ECX
MOV ESI, (offset beginning)
push ESI

00401F0C: XOR BYTE PTR DS: [ESI], 30
INC ESI
LOOPD SHORT 00401F0C
RETN

Can someone give me a hint how to start ? I already tried some upxfixers but they didn't work.

Moi
02-14-2006, 08:02 PM
Already solved it. Just a xorred upx scrambler.

alex_dump
07-12-2006, 10:22 AM
I'm new here and somewhat new to cracking, but I came across this tool which might be helpful regarding this UPX scramble. Its called Anti-UPX Scramble v1.0:

http://cim.astalavista.ms/file=D...iption&dl_id=68 (http://cim.astalavista.ms/file=Download&op=description&dl_id=68)