unpacking dgvoodoo

anti-unpacking-tricks.md

Unpacking an Executable using UPX + Anti-Unpacking Tricks

1. Restore Section Header Names

   • The section header names had been erased.
   • Rename the relevant sections to UPX0 and UPX1 to match the original UPX convention.

2. Restore the UPX! Magic

   • The UPX! magic signature was zeroed out.
   • It is normally located 32 bytes before the start of the actual UPX1 section data.
   • Use a hex editor to write UPX! at this location.

3. Unpack Using UPX

   • With section names and magic restored, you can now unpack the executable using UPX:

     upx -d <filename>

4. Reconstruct Missing Original First Thunks (OFTs)

   • The Original First Thunks in the Import Directory were missing: https://learn.microsoft.com/en-us/archive/msdn-magazine/2002/march/inside-windows-an-in-depth-look-into-the-win32-portable-executable-file-format-part-2#the-imports-section
   • To fix this:
     • Create a new section in the PE file.
     • Copy the First Thunk (FT) data from the .rdata section into this new section.
     • Set the OFT RVAs in the Import Directory to point to the new section.