hasherezade / mal_unpack Goto Github PK

Hi Hasherezade,

Many thanks for creating such an awesome tool. This along with the driver is such a great tool to use.

I am testing malunpack with dll's. I have used it to unpack qakbot sucessfully, but it does not seem to work for bumblebee.

I hash I am using is: FED9BC8DF9141F8F8F7A9203BC26B5B22123C154702FCD625379F2F7ECD31CB2

The export for the sample is : hKOgtkmCis

While debugging I see that the sample does not use VirtualAlloc. If I set a break point on VirtualAlloc, when it hits the breakpoint, the ERW section with mapped PE file is already created. Maybe that is the case why the unpacking is failing.

Any suggestions would be appreciated.

Since you align up the virtual and raw size, you might need to change SizeOfHeaders too. It should be 0x1000 (the raw offset of the first section) for the example.

UPD: I've found MS docs regarding PE format and it says "The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment. " (link) So, it seems everything is fine, but in most executables the end of the PE header is the start of the first section. PeTools also align up to 0x1000 "SizeOfHeaders".

The original looks like:

Hello,

it would be useful to include the possibility to directly unpack DLLs.