Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > File Unpacking
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 12-09-2004, 04:58 PM
AarzaK AarzaK is offline
Member
 
Join Date: Nov 2004
Location: Caracas - Venezuela
Posts: 8
Send a message via MSN to AarzaK
Default BRAT in .data, .text....

Hi, sorry my question. I "unpacking" a .exe with upx, now says this BRAT in all sections.

How I can Solved this? now says BRAT

what is BRAT?

Sorry my English.

Regards.
__________________
I Was Sent....
[url='http://aarzak.fadlan.com']http://aarzak.fadlan.com[/url]
Reply With Quote
  #2  
Old 12-10-2004, 05:54 AM
CoDe_InSiDe CoDe_InSiDe is offline
Member
 
Join Date: Nov 2003
Posts: 28
Default

Hi AarzaK,

I believe BRAT is the author of the tool you used to unpack UPX
He puts his name in the sections because you used that unpacking tool
You can simply change the sections names in whatever you want.

Regards,

CoDe_InSiDe
Reply With Quote
  #3  
Old 12-10-2004, 12:43 PM
AarzaK AarzaK is offline
Member
 
Join Date: Nov 2004
Location: Caracas - Venezuela
Posts: 8
Send a message via MSN to AarzaK
Default :)

HI CoDe_InSiDe;

Code:
Object table:



# *Name * VirtSize * * RVA * * *PhysSize *Phys off *Flags

__________________________________________________________________

01 UPX0 * 00133000 * 00001000 * 00000000 *00000400 E0000080 [UERW]

02 UPX1 * 000A3000 * 00134000 * 000A2A00 *00000400 E0000040 [IERW]

03 .rsrc *00002000 * 001D7000 * 00001C00 *000A2E00 C0000040 [IRW]







later, I use Unpacker (Upx)





examply no remember the REAL VirtSize,RVA,PhysSize,Phys off and *Flags.



# *Name * VirtSize * * RVA * * *PhysSize *Phys off *Flags

__________________________________________________________________

01 BRAT * 00000000 * 00000000 * 00000000 *00000000 00000000 [UERW]

02 BRAT * 00000000 * 00000000 * 00000000 *00000000 00000000 [IERW]

03 BRAT * 00000000 * 00000000 * 00000000 *00000000 00000000 [IRW]
and OllyDbg equal says:

"code encryted or compress ........bla,bla,bla"
and cannot open the .exe fine

this is my problem who I can solve this??

I no have Experience in compressed/packed/encripted .exe

Best Regards!
__________________
I Was Sent....
[url='http://aarzak.fadlan.com']http://aarzak.fadlan.com[/url]
Reply With Quote
  #4  
Old 12-10-2004, 01:31 PM
zyzygy zyzygy is offline
Member
 
Join Date: Oct 2004
Location: !nfern0
Posts: 9
Send a message via Yahoo to zyzygy
Default

hi ,

you could use the unpacker in proc-dump or upx itself .i think the unpacker you are using seems to has goofed up with the exe.

zyzygy
__________________
Never hold up farts-They go upto your spine , enter your brain and thats where the shitty ideas come from
Reply With Quote
  #5  
Old 12-12-2004, 12:06 PM
AarzaK AarzaK is offline
Member
 
Join Date: Nov 2004
Location: Caracas - Venezuela
Posts: 8
Send a message via MSN to AarzaK
Default :)

Problem->Solved

I use the upx, c:upx -d programname.exe


__________________
I Was Sent....
[url='http://aarzak.fadlan.com']http://aarzak.fadlan.com[/url]
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2020, Jelsoft Enterprises Ltd.