When the 'packer' is just UPX and a skip-upx trick

The screenshot is the useful part of the post. On «When the 'packer' is just UPX and a skip-upx trick»: UPX, but they patched the magic so upx -d shrugs. I trust FLOSS after I have seen the decoder. Before that I read the stores. Version in my shot: current lab snapshot, not last year's blog.

Came back to this after a coffee. Still hold. On «When the 'packer' is just UPX and a skip-upx trick»: UPX, but they patched the magic so upx -d shrugs. UPX with a skipped magic is still UPX. Restore four bytes and move on. I wrote a 12-line script and then threw it away. The listing was enough.

@anthonyhub

The screenshot is the useful part of the post. On «When the 'packer' is just UPX and a skip-upx trick»: UPX, but they patched the magic so u

That is not what the listing shows. You are arguing a vibe. Quietly the best note on this board this month. On «When the 'packer' is just UPX and a skip-upx trick»: UPX, but they patched the magic so upx -d shrugs. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Same class as the June thread, different binary.

@christopherx

Same wall I hit last quarter. «When the 'packer' is just UPX and a skip-upx trick» — specifically UPX, but they patched the magic so upx -d

Call-convention guess is not evidence. This is the kind of thread that should be a sticky and is not. You wrote «UPX, but they patched the magic so upx -d shrugs». That is the sentence I keep. UPX with a skipped magic is still UPX. Restore four bytes and move on. My note id for this: 33-05.

@bluehat

Came back to this after a coffee. Still hold. On «When the 'packer' is just UPX and a skip-upx trick»: UPX, but they patched the magic so up

I read the patch. You read a tweet. Those are not the same source. Same wall I hit last quarter. «When the 'packer' is just UPX and a skip-upx trick» — specifically UPX, but they patched the magic so upx -d shrugs. UPX with a skipped magic is still UPX. Restore four bytes and move on. Can you quote the offset instead of the graph screenshot? I reproduced it on lab build 1336.

@byte

Same wall I hit last quarter. «When the 'packer' is just UPX and a skip-upx trick» — specifically UPX, but they patched the magic so upx -d

Same wall I hit last quarter. «When the 'packer' is just UPX and a skip-upx trick» — specifically UPX, but they patched the magic so upx -d shrugs. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I wrote a 12-line script and then threw it away. The listing was enough.

I want the listing, not the decompiler story. The load-bearing line: UPX, but they patched the magic so upx -d shrugs. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I will +rep a listing and −rep a vibe. That is the deal.

@cryptx

I want the listing, not the decompiler story. The load-bearing line: UPX, but they patched the magic so upx -d shrugs. FID for your own libs

Do not call people skids because they use Ghidra. This belongs in the first-hour ritual. «When the 'packer' is just UPX and a skip-upx trick» — specifically UPX, but they patched the magic so upx -d shrugs. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I still have the snapshot named reve-51-pre.

Not fully convinced yet. «When the 'packer' is just UPX and a skip-upx trick» — specifically UPX, but they patched the magic so upx -d shrugs. I leave CET ops in the listing. They document that CET is on. After you did that, did the decompiler pick it up or did you dump? Pinned a comment at 0x14000416d in the listing.