Retdec unpacker: overlay breaks UPX unpacking
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
Sample `c787e57a8077f0df838ae416cbf6dd38ecc670e532c3369bff2ef571cd94d36e` contains its configuration in the last 128 bytes that are placed after the trailing UPX header. This will fool both `upx -d` and `retdec-unpacker`, that will exit with:
```
[UPX] Detected NRV2B unpacking stub based on signature & metadata.
[UPX] Started unpacking of file 'c787e57a8077f0df838ae416cbf6dd38ecc670e532c3369bff2ef571cd94d36e'.
[UPX] Unfiltering filter 0x0 with parameter 0.
[UPX] Unpacking block at file offset 0x198.
[UPX] Unfiltering filter 0x49 with parameter 5.
[UPX] Unpacking block at file offset 0x5b58.
[UPX] Unfiltering filter 0x0 with parameter 0.
[UPX] Unpacking block at file offset 0x82fa.
[UPX] Unfiltering filter 0x0 with parameter 0.
[UPX] Unpacking block at file offset 0xc5bf.
[ERROR] [UPX] Invalid block found.
[UPX] Exiting with cached exit code 2
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the failure with sample c787e57a8077f0df838ae416cbf6dd38ecc670e532c3369bff2ef571cd94d36e using both upx -d and retdec-unpacker. Trace how retdec-unpacker handles the trailing 128-byte overlay after the UPX header, and verify that the sample unpacks successfully without the invalid-block error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100