Reverse Engineering Chat — public feed snapshot · snapshot for February 2024

The -9 is also a useless switch for decompression. Now you have to use a debuggers or something else to manually unpack upx. There are lots of tutorials for that

21:53

If it's really modified upx.

21:53

Foster Tales

M.The -9 is also a useless switch for decompression. Now you have to use a debuggers or something else to manually unpack upx. There are lots of tutorials for that

Ссылка
click to show

Am I in the right path? https://kausrini.github.io/2021-06-20-unpacking-upx-manually/

22:03

Yes. I'd suggest to use x64dbg tho, but olly will be fine

22:05

Foster Tales

M.Yes. I'd suggest to use x64dbg tho, but olly will be fine

Just I don't know how can I do that from radare😅

22:06

I guess with r2 you can dump it too

22:06

Ссылка
click to show

https://infosecwriteups.com/how-to-unpack-upx-packed-malware-with-a-single-breakpoint-4d3a23e21332 Any tutorial will do. Upx didn't really change in that regard in the last 25 years

22:08

You can also debug with r2, stop at the oep and then dump with scylla

22:09

Foster Tales

M.You can also debug with r2, stop at the oep and then dump with scylla

OK, thanks

22:10

What you think about rib files?

22:10

Enjoy! Manually unpacking is a cool adventure.

22:10

Foster TalesWhat you think about rib files?

I have no clue what that is. Does not sound too RE related to me

22:11

StepN Airdrop

M.Do you have a dll to inject? Does your target have imports?

Thanks bro for your help i appreciate that, i kind of understood the required to perform dll injections

22:13

Foster Tales

M.I have no clue what that is. Does not sound too RE related to me

And I. This files from the Manhunt and towav.exe the only programm in the Internet when can unpack(?) this files...

22:14

Mb have another way when can rewrite these files...

22:15

A snapshot of an open public feed from the search index ChatCrawler — “Google for public Telegram”; refreshed as the venue is crawled. Times are UTC.