Lab18-01.exe is Lab 14-1 Solutions packed with a slightly modified version of UPX, one of the most popular packers encountered in the wild. The modifications to UPX make it more resistant to signature detection. When you run PEiD on the packed executable, it does not detect the packer. However, a section in the file named UPX2 should make you suspect that a UPX-like packer is being used. Running UPX –d on the packed file fails because of the modifications made to the packer.

We first try to unpack the program manually by loading the program in OllyDbg to find the OEP. First, we simply page down through the code to see if the tail jump is obvious. As you can see in Example C-173, it is.

00409F32    CALL EBP
00409F34    POP EAX
00409F35    POPAD
00409F36    LEA EAX,DWORD PTR SS:[ESP-80]
00409F3A    PUSH 0
00409F3C    CMP ESP,EAX
00409F3E    JNZ SHORT Lab14-1.00409F3A
00409F40    SUB ESP,-80
00409F43   ❶JMP Lab14-1.0040154F
00409F48    DB 00
00409F49    DB 00
00409F4A    DB 00
00409F4B    DB 00
00409F4C    DB 00
00409F4D    DB 00
00409F4E    DB 00

The tail jump at ❶ is followed by a series of 0x00 bytes. It jumps to a location that is very far away. We set a breakpoint on the tail jump and resume execution of our program. Once the breakpoint is hit, we single-step on the jmp instruction to take us to the OEP.

Next, we dump the process to a disk using Plugins ▸ OllyDump ▸ Dump Debugged Process. Accept all of the default options, click Dump, and then select a filename for the dumped process.

We’ve dumped the unpacked program to disk, and we’re finished. We can now view the program’s imports and strings, and easily analyze it with IDA Pro. A quick analysis reveals that this is the same code as Lab 14-1 Solutions.