Skip to main content
Tweeted twitter.com/#!/StackReverseEng/status/361608534888165376
Heavy clean-up
Source Link
Jason Geffner
  • 20.7k
  • 1
  • 38
  • 75

How to go through multi-layer obfuscationunpack files packed with multiple packers?

Commonly - and asAs I am just startinggetting started in RE, I face onlyI've mostly faced files packed with a single-layer encryption algorithmsof packing , such as upx UPX, aspackASPack, etc ..
Solving

Unpacking these protections is fully described everywhere documented online. The problem begins when I deal with multi-layer encryptionmultiple layers of packing -, especially concerning malwares, sincemalware. I have followed some tuts -tutorials though they're usually not detailed enough, they seems. They seem to go through a tedious process to getfind the OEP. For example  , they start firstly to dealby dealing with a common packers - which(which is the easy part :p) and then they begin to set breakpoints everywhere "in calls and jumps "" and tracing through the file here and there, which is for me the hard part that iI have described earlierabove. At this point, I have no clue for what they are seeking for or for what they are aiming  , and then after some work  , they getfind the OEP ?!
So

So what logic did they follow in that process and also? Also, because I know that the subject is large broad, I'm also interested in some keywords ?.

How to go through multi-layer obfuscation?

Commonly - and as I am just starting RE, I face only single-layer encryption algorithms , such as upx , aspack etc ..
Solving these is fully described everywhere . The problem begins when I deal with multi-layer encryption - especially concerning malwares, since I have followed some tuts - usually not detailed enough, they seems to go through a tedious process to get the OEP. For example  , they start firstly to deal with a common packers - which is the easy part :p and then they begin to set breakpoints everywhere "in calls and jumps " and tracing through the file here and there, which is for me the hard part that i have described earlier. At this point, I have no clue what they are seeking for or what they are aiming  , then after some work  , they get the OEP ?!
So what logic did they follow in that process and also because I know that the subject is large , I'm also interested in some keywords ?

How to unpack files packed with multiple packers?

As I am just getting started in RE, I've mostly faced files packed with a single-layer of packing , such as UPX, ASPack, etc.

Unpacking these protections is fully documented online. The problem begins when I deal with multiple layers of packing, especially concerning malware. I have followed some tutorials though they're usually not detailed enough. They seem to go through a tedious process to find the OEP. For example, they start by dealing with common packers (which is the easy part) and then they begin to set breakpoints everywhere "in calls and jumps" and tracing through the file here and there, which is for me the hard part that I have described above. At this point, I have no clue for what they are seeking or for what they are aiming, and then after some work, they find the OEP!

So what logic did they follow in that process? Also, because I know that the subject is broad, I'm also interested in some keywords.

how How to go through multi-layer encryptionobfuscation?

  • Commonly - and as i am just starting RE - , i face only single-layer encryption algorithms , such as upx , aspack etc .. solving these is fully described everywhere . the problem begins when i deal with multi-layer encryption -especially when dealing with malwares - , since i have followed some tuts -usually not detailed enough- , they seems to go through a tedious process to get the oep, for example , they start firstly to deal with a common packers -which is the easy part :p- , and then they begin to set breakpoints everywhere "in calls and jumps " and tracing through the file here and there -which is for me the hard part that i have described earlier- , and at this point i have no clue what they are seeking for or what they are aiming , then after some work , they get the oep ?! so what logic did they follow in that process , and also because i know that the subject is large , i'm also interested in some keywords ?

Commonly - and as I am just starting RE, I face only single-layer encryption algorithms , such as upx , aspack etc ..
Solving these is fully described everywhere . The problem begins when I deal with multi-layer encryption - especially concerning malwares, since I have followed some tuts - usually not detailed enough, they seems to go through a tedious process to get the OEP. For example , they start firstly to deal with a common packers - which is the easy part :p and then they begin to set breakpoints everywhere "in calls and jumps " and tracing through the file here and there, which is for me the hard part that i have described earlier. At this point, I have no clue what they are seeking for or what they are aiming , then after some work , they get the OEP ?!
So what logic did they follow in that process and also because I know that the subject is large , I'm also interested in some keywords ?

how to go through multi-layer encryption?

  • Commonly - and as i am just starting RE - , i face only single-layer encryption algorithms , such as upx , aspack etc .. solving these is fully described everywhere . the problem begins when i deal with multi-layer encryption -especially when dealing with malwares - , since i have followed some tuts -usually not detailed enough- , they seems to go through a tedious process to get the oep, for example , they start firstly to deal with a common packers -which is the easy part :p- , and then they begin to set breakpoints everywhere "in calls and jumps " and tracing through the file here and there -which is for me the hard part that i have described earlier- , and at this point i have no clue what they are seeking for or what they are aiming , then after some work , they get the oep ?! so what logic did they follow in that process , and also because i know that the subject is large , i'm also interested in some keywords ?

How to go through multi-layer obfuscation?

Commonly - and as I am just starting RE, I face only single-layer encryption algorithms , such as upx , aspack etc ..
Solving these is fully described everywhere . The problem begins when I deal with multi-layer encryption - especially concerning malwares, since I have followed some tuts - usually not detailed enough, they seems to go through a tedious process to get the OEP. For example , they start firstly to deal with a common packers - which is the easy part :p and then they begin to set breakpoints everywhere "in calls and jumps " and tracing through the file here and there, which is for me the hard part that i have described earlier. At this point, I have no clue what they are seeking for or what they are aiming , then after some work , they get the OEP ?!
So what logic did they follow in that process and also because I know that the subject is large , I'm also interested in some keywords ?

Source Link
Higet
  • 437
  • 4
  • 8

how to go through multi-layer encryption?

  • Commonly - and as i am just starting RE - , i face only single-layer encryption algorithms , such as upx , aspack etc .. solving these is fully described everywhere . the problem begins when i deal with multi-layer encryption -especially when dealing with malwares - , since i have followed some tuts -usually not detailed enough- , they seems to go through a tedious process to get the oep, for example , they start firstly to deal with a common packers -which is the easy part :p- , and then they begin to set breakpoints everywhere "in calls and jumps " and tracing through the file here and there -which is for me the hard part that i have described earlier- , and at this point i have no clue what they are seeking for or what they are aiming , then after some work , they get the oep ?! so what logic did they follow in that process , and also because i know that the subject is large , i'm also interested in some keywords ?