WinUpack

[ubermage]

I'm trying to unpack a WinUpack PE, but I can't find any unpackers and I'm pretty dumb with unpacking stuff. Can anybody give me any hints to unpack WinUpack packed files?

[LaFarge]

00401018 > $ *BE B0114000 * MOV * * ESI, WinUpack.004011B0
0040101D * . *AD * * * * * *LODS * *DWORD PTR DS:[ESI]
0040101E * . *50 * * * * * *PUSH * *EAX
0040101F * . *FF76 34 * * * PUSH * *DWORD PTR DS:[ESI+34]
00401022 * . *EB 7C * * * * JMP * * SHORT WinUpack.004010A0

Above snippet is from WinUPackE.exe (which is packed with WinUPack).

Only thing u need to do is to trace with F8 until PUSH EAX and execute it. Now EIP should be on PUSH DWORD PTR DS:[ESI+34].

Now u do the dirty old ESP trick and voila, u're on OEP, or here:

0040A4BE * *55 * * * * * * *PUSH * *EBP * * * * * * * * * * * * * * ; kernel32.GetProcAddress
0040A4BF * *8BEC * * * * * *MOV * * EBP, ESP
0040A4C1 * *6A FF * * * * * PUSH * *-1
0040A4C3 * *68 F0C94000 * * PUSH * *WinUpack.0040C9F0
0040A4C8 * *68 D8A64000 * * PUSH * *WinUpack.0040A6D8 * * * * * * * ; JMP to msvcrt._except_handler3
0040A4CD * *64:A1 00000000 *MOV * * EAX, DWORD PTR FS:[0]
0040A4D3 * *50 * * * * * * *PUSH * *EAX

which is OEP actually. Rest is up to u :D