hasherezade / mal_unpack Goto Github PK
View Code? Open in Web Editor NEWDynamic unpacker based on PE-sieve
License: BSD 2-Clause "Simplified" License
Dynamic unpacker based on PE-sieve
License: BSD 2-Clause "Simplified" License
Hi Hasherezade,
Many thanks for creating such an awesome tool. This along with the driver is such a great tool to use.
I am testing malunpack with dll's. I have used it to unpack qakbot sucessfully, but it does not seem to work for bumblebee.
I hash I am using is: FED9BC8DF9141F8F8F7A9203BC26B5B22123C154702FCD625379F2F7ECD31CB2
The export for the sample is : hKOgtkmCis
While debugging I see that the sample does not use VirtualAlloc. If I set a break point on VirtualAlloc, when it hits the breakpoint, the ERW section with mapped PE file is already created. Maybe that is the case why the unpacking is failing.
Any suggestions would be appreciated.
Since you align up the virtual and raw size, you might need to change SizeOfHeaders too. It should be 0x1000 (the raw offset of the first section) for the example.
UPD: I've found MS docs regarding PE format and it says "The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment. " (link) So, it seems everything is fine, but in most executables the end of the PE header is the start of the first section. PeTools also align up to 0x1000 "SizeOfHeaders".
Hello,
it would be useful to include the possibility to directly unpack DLLs.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.