avast / avast/retdec

Retdec unpacker: overlay breaks UPX unpacking

Open
#971 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Sample `c787e57a8077f0df838ae416cbf6dd38ecc670e532c3369bff2ef571cd94d36e` contains its configuration in the last 128 bytes that are placed after the trailing UPX header. This will fool both `upx -d` and `retdec-unpacker`, that will exit with:

```
[UPX] Detected NRV2B unpacking stub based on signature & metadata.
[UPX] Started unpacking of file 'c787e57a8077f0df838ae416cbf6dd38ecc670e532c3369bff2ef571cd94d36e'.
[UPX] Unfiltering filter 0x0 with parameter 0.
[UPX] Unpacking block at file offset 0x198.
[UPX] Unfiltering filter 0x49 with parameter 5.
[UPX] Unpacking block at file offset 0x5b58.
[UPX] Unfiltering filter 0x0 with parameter 0.
[UPX] Unpacking block at file offset 0x82fa.
[UPX] Unfiltering filter 0x0 with parameter 0.
[UPX] Unpacking block at file offset 0xc5bf.
[ERROR] [UPX] Invalid block found.
[UPX] Exiting with cached exit code 2
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the failure with sample c787e57a8077f0df838ae416cbf6dd38ecc670e532c3369bff2ef571cd94d36e using both upx -d and retdec-unpacker. Trace how retdec-unpacker handles the trailing 128-byte overlay after the UPX header, and verify that the sample unpacks successfully without the invalid-block error.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.