upx manual shelling

Charles shell

 

 UPX 0.89.6 - 1.02 / 1.05 - 2.90 (Delphi) stub -> Markus & Laszlo

Such manual compression shelling upx shell is very simple.

First, find oep

Two, dump, repair IAT

 

• First, find oep

way1：

First discovered pushad instruction in program entry, then find direct instruction popad

 

 

 

 

 In the off jmp instruction, operation.

After jmp came oep

 

 

 

 

---

 

way2:

Of course, it can after a single step pushad, go esp memory window, set hardware breakpoints, run, find jmp place.

 

 

 

 After running the command will stop after popad

 

 Tracking jmp will go oep

 

---

 

• 二、dump、fix dump

 Scylla use in x64dbg

 

 

Failure delete function.

 

At last

 

 Shelling is completed.

 

 If not repaired, run the program directly can cause an error

IAT fix the program can run normally. [Fix dump]