Results 1 to 4 of 4

Thread: problem with resource section after unpacking

  1. #1
    galack
    Guest

    problem with resource section after unpacking

    Hello,

    Im analysing a piece of malware, its packed with an unknown packer, as far as ive seen all it does is xor decryption, ive managed to unpack it and rebuild its import table with imprec, however it does not run, when i traced it , i found that it exits when it tries to read its resource with LoadResource, the resource section seems to be messed up but i have no idea what to do next, how to fix it.

    any hint is appreciated.

    GCK
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    Why don't you zip it with a password and post it here? It will help others to help you.

  3. #3
    galack
    Guest

    ...

    Hello,

    its a big file 32mb and im on a slow connection, it has lot of files embedded into its resource, thats why i need to fix the resource section in order to analyze it, every essay dealing with unpacking ive seen doesnt even mention the resources section, if i dumped the executable at its entry point, why is the rsrc section corrupted ? shouldnt it have already fixed it ?

    best regards
    GCK
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    Hello galack,

    there are tools out there which maybe able to solve your problem. Take a look here http://www.woodmann.com/collaborative/tools/index.php/ResFixer.

    Regards
    Nukacola
    Shot smart, shop s-mart

Similar Threads

  1. PeCompact 2.X unpacking problem
    By robson in forum Malware Analysis and Unpacking Forum
    Replies: 2
    Last Post: April 8th, 2013, 18:16
  2. ELF - problem with unpacking
    By danci in forum Malware Analysis and Unpacking Forum
    Replies: 0
    Last Post: November 19th, 2010, 09:57
  3. putting breakpoint on a string which is define in resource sectionů
    By megatron in forum OllyDbg Support Forums
    Replies: 1
    Last Post: January 12th, 2009, 16:34
  4. Strange problem after unpacking
    By tazmanian in forum Malware Analysis and Unpacking Forum
    Replies: 9
    Last Post: February 19th, 2003, 17:49
  5. problem after unpacking asprotect
    By loman in forum Malware Analysis and Unpacking Forum
    Replies: 7
    Last Post: September 11th, 2002, 21:17

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •