avast / avast/retdec

in upx unpacker IAT is missed?

Open
#903 0 comments 0 reactions 0 assignees View on GitHub
C-unpacker
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

I checked retdec-unpacker.exe with a compressed exe (win 64 by UPX last version 2020) , It decompressed but I think IAT is missed and can not run the exe!

**fileinfo:**
Input file : 1.exe
CRC32 : c464362e
MD5 : b0635d6e1c1ad1d2d9ec5f225b6c0e21
SHA256 : d314c0a78c25f7f62b678f22f621802758a694cf840660b9a83631ae3e23935d
File format : PE
File class : 64-bit
File type : Executable file
Architecture : x86-64
Endianness : Little endian
Image base address : 0x140000000
Entry point address : 0x1403b1c50
Entry point offset : 0x119050
Entry point section name : (entry point section does not have a name)
Entry point section index: 1
Bytes on entry point : 53565755488d35a573eeff488dbe0080d6ff488d8758fa3400ff30c700051d402c505731db31c94883cdffe85000000001db
Detected tool : UPX (3.96 [NRV2E] [Filter: 0x49, Param: 0x36]) (packer), strings heuristic
Detected tool : Microsoft (linker), dos header style
Rich header offset : 0x80
Rich header key : 0x86acf2b8
Rich header signature : 0103685b0000001701056fc60000000a0105685b00000093010471be00000011010371be00000009010571be
000000380104685b000000250101685b00000027000100000000012d010972960000010800ff729600000001
00970000000000010102729600000001
Overlay offset : 0x13d200
Overlay size : 0x21b0
Overlay entropy : 7.525

**C:\1\2\bin>retdec-unpacker.exe 1.exe**
[UPX] Detected NRV2E unpacking stub based on metadata.
[UPX] Started unpacking of file '1.exe'.
[UPX] Detected filter 0x49 with parameter 0x36 based on UPX metadata.
[UPX] Unpacked data based on UPX metadata.
[UPX] Original header found at address 0x3af21f in extra data.
[UPX] Import hints address 0x3ad000 found in extra data.
[UPX] Relocations hints address 0x3ae1ad found in extra data.
[UPX] Original TLS directory found at RVA 0x30f700 with size 0x28.
[UPX] Original entry point address set to 0x249458.
[UPX] Original load configuration directory found at RVA 0x30f550 with size 0x138.
[UPX] Original resources directory found at RVA 0x380000 with size 0x2a340.
[UPX] Packed file has overlay with size of 0x21b0 bytes. Copying into unpacked file.
[UPX] Successfully unpacked '1.exe'!

but when I run it:
---------------------------
1.exe-unpacked.exe - Application Error
---------------------------
The application was unable to start correctly (0xc0000005). Click OK to close the application.
---------------------------
OK
---------------------------

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the report with retdec-unpacker.exe and the supplied 64-bit UPX-packed executable, then inspect the unpacking output around the reported missing IAT. Done means the unpacked executable preserves its imports and starts without the reported 0xc0000005 error.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.