avast / avast/retdec

fileinfo detects both UPX and MPRESS for the same PE binary file

Open
#274 3 comments 0 reactions 0 assignees View on GitHub
bug C-cpdetect C-fileinfo P-output
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

`fileinfo` detects both UPX and MPRESS for the same PE binary file.

## Input

Run
```
$ retdec-fileinfo FILE
```
where `FILE` is:
* [`27AA4828D922898A79BA22A297C275132A562CFCD4A2CA37D9E3A567E9C4D4E5`](https://www.virustotal.com/#/file/27aa4828d922898a79ba22a297c275132a562cfcd4a2ca37d9e3a567e9c4d4e5/details)

## Output

```
...
Detected tool: Microsoft Linker (7.1) (linker), combined heuristic
Detected tool: UPX (packer), section table heuristic
Detected tool: MPRESS (2.12 - 2.19 [LZMA]) (packer), 84 from 84 significant nibbles (100%)
Detected tool: MPRESS (1.x - 2.x) (packer), 76 from 76 significant nibbles (100%)
...
```

## Expected output

I suggest checking why we detect both UPX and MPRESS for the above file. Are both of these detections really correct? When I try to unpack the file via `retdec-unpacker`, I get the following output:
```
$ retdec-unpacker 27AA4828D922898A79BA22A297C275132A562CFCD4A2CA37D9E3A567E9C4D4E5
No matching plugins found for 'Microsoft Linker 7.1'
[ERROR] [UPX] Unsupported unpacking stub detected.
[MPRESS] Successfully unpacked '27AA4828D922898A79BA22A297C275132A562CFCD4A2CA37D9E3A567E9C4D4E5'!
```

## Configuration

* Commit: 76c24b8a054ec9bd98867087ea00e395f8e3a872 (current `master`)
* 64b Arch Linux, GCC 7.3.1, Debug build of RetDec

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the report with retdec-fileinfo on the supplied SHA-256 sample, then compare its UPX and MPRESS detections with retdec-unpacker, which successfully uses MPRESS and rejects UPX. Trace the detection heuristics and unpacker entry points to determine whether both signatures can be valid; done means the reported tool identification is accurate and the conflicting result is resolved or clearly explained.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.