unscramble upx help please

[nemious]

I was unpacking a program and I got stuck on the upx unscrambleing and I was woundering if anyone could give me some information on this thanks.

[dila]

Don't most packers *unpack* the data at some point?

I don't know much about unpacking, but you might like to try setting a breakpoint on LoadLibrary or GetProcAddress, this will probably land you at a place after most of the unpacking has already been done. In standard UPX I think the final 'jmp' in the packed code section will take you to the unpacked code.

** not guaranteed to be accurate

[nemious]

The program is all ready unpacked I just need to unscramble it. I actuly dont think it is scrambled belive it is ms crypto I have managed to get the hashs out of the program then the next thing I did was made sure that they were valid witch they are. So now I have no idea of what the next step should be. I was think that I dont have to crack the hashs to break ms crypto. Even if I do actuly have to crack them It will not be that big of a deal since I have the hashs all ready.