avast / avast/retdec

UPX packed sample unpacked by retdec-unpacker has less resources than when unpacked by upx

Open
#915 0 comments 0 reactions 0 assignees View on GitHub
bug C-unpacker T-format-pe
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

When `0628fa316e862c7b4c810d15e7cc60483a23e0b80f5f5616eabc63b6fc583503` is unpacked by retdec-unpacker then it has 20 resources but when it's unpacked by UPX it has 31 resources. Please verify why it has less resources and try to resolve it.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by unpacking sample 0628fa316e862c7b4c810d15e7cc60483a23e0b80f5f5616eabc63b6fc583503 with retdec-unpacker and UPX, then compare their resource counts and outputs. Trace the retdec-unpacker entry points involved in resource handling to identify why 20 resources are retained instead of 31. Done means the retdec-unpacker output preserves the expected resources.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.