Previously, losing the PE file header rendered the executable completely inoperable and unrepairable. The UPX Unpacker attempts to recover a file, even when an original PE file header entry is no longer available after unpacking. Now you can open these obfuscated files even without knowing that: your file will be unpacked automatically! Previously, you had to run the executable and dump the packed segments right after the executable had been completely unpacked in memory. This technique often is used by malware authors to make unpacking and reverse engineering harder. The UPX Unpacker plug-in works on packed malware executables and can handle a file even if it has been packed with UPX and modified manually so that UPX cannot be used directly to unpack the file, because internal structures have been modified, for example the names of the sections have been changed from UPX to XYZ, or the version number of the UPX format has been changed from 1.20 to 3.21. See also: Upack Unpacker What are packers? The UPX Unpacker displays lines of messages in the bottom log window as follows: That is why the original file size may be increased after you open and save the executable WITHOUT making ANY changes to it in PE Explorer. PE Explorer does not re-pack the previously packed files back to the exact original size. The resulted file will also be saved unpacked.
When you open a file with PE Explorer, the UPX Unpacker plug-in detects whether the file is packed with UPX, and then your file will be unpacked automatically. Now you can open files compressed with UPX even without knowing that! In addition, PE Explorer supports for files modified with many UPX scramblers such as Advanced UPX Scrambler, UPoLyX, UPX Lock, and even more: now it supports for Upack and NSPack. All versions of UPX are supported, from the obsolete early versions (prior to 0.80) up to the latest 3.9x versions. PE Explorer ships with the UPX Unpacker plug-in, a start-up processing plug-in for unpacking files compressed with UPX. Home products pe explorer feature tour UPX UNPACKER PLUG-IN Automatic UPX Unpacking
0 kommentar(er)
