« first day (3520 days earlier)      last day (717 days later) » 

MendelG
MendelG
15:31
How can I unpack an EXE that's packed with multiple packers?

I have a file that's packed with multiple packers. Now, there are multiple ways to unpack packed files, such as finding the Original Entry Point. My problem is that it seems like the executable is packed with multiple packers. I can't just find the OEP, since, even if I do, it will still be packed with another packer.

Should I place breakpoints on VirtualAlloc/VirtualProtect?
I've seen the question being asked on the site:
https://reverseengineering.stackexchange.com/questions/2552/how-to-unpack-files-packed-with-multiple-packers
however, I didn't really get an answer from that
@0xC0000022L I see that you're a mod, so I'll tag you if you don't mind :) since I don't see that this chat is too active...
On the other hand, it might just be that my file is packed with an unknown packer. I have already tried to find the OEP and dump the file, but that didn't work..
 
1 hour later…
0xC0000022L
0xC0000022L
17:11
@MendelG No problem, but the chat isn't really for asking and answering ... more for clarifying and just chatting about related and unrelated topics.
@MendelG I doubt these breakpoints would help you. But it depends on the packers, so certainly you could give it a try.
Many runtime packers will reserve the needed space via the section headers and unpack right there instead of employing any Windows API ...

« first day (3520 days earlier)      last day (717 days later) »