First, we run PEiD on the Lab18-02.exe file, and we learn that the packer is FSG 1.0 -> dulek/xt. To unpack this program manually, we first load it into OllyDbg. Several warnings state that the file may be packed. Since we already know that, we just click through the warnings.

When we load the program, it starts at entry point 0x00405000. The easiest approach is to try the Find OEP by Section Hop option in the OllyDump plug-in. We select Plugins ▸ OllyDump ▸ Find OEP by Section Hop (Trace Over), which stops the program at 0x00401090. This is encouraging, because 0x00401090 is close to the beginning of the executable. (The first set of executable instructions within a PE file is typically located at 0x00401000, and this is only 0x90 past that, which suggests that the Find OEP plug-in tool has worked.) At the instruction identified by the OllyDump plug-in, we see the code in Example C-174.

00401090     DB 55                                    ;  CHAR 'U'
00401091     DB 8B
00401092     DB EC
00401093     DB 6A                                    ;  CHAR 'j'
00401094     DB FF
00401095     DB 68                                    ;  CHAR 'h'

Depending on your version, OllyDbg may not have disassembled this code because it did not realize that it is code. This is somewhat common and unpredictable when dealing with packed programs, and it can be a sign that the code is part of the original code, rather than part of the unpacking stub. To force OllyDbg to disassemble the code, right-click the first byte and select Analysis ▸ Analyze Code. This displays the code for the beginning of the program, as shown in Example C-175.

00401090  PUSH EBP                ;  msvcrt.77C10000
00401091  MOV EBP,ESP
00401093  PUSH -1
00401095  PUSH Lab07-02.00402078
0040109A  PUSH Lab07-02.004011D0

The first two instructions in Example C-175 look like the start of a function, further convincing us that we have found the OEP. Scrolling down a little, we also see the string www.practicalmalwareanalysis.com, which is further evidence that this is part of the original program and not the unpacking stub.

Next, we dump the process to a disk using Plugins ▸ OllyDump ▸ Dump Debugged Process. Leave all of the default options, click Dump, and select a filename for the dumped process.

Now, we’re finished. We can view the program’s imports and strings, and easily analyze it with IDA Pro. A quick analysis reveals that this is the same code as Lab07-02.exe.