Working with UPX - Manual Unpacking with IDA Pro, x32dbg and Scylla

[@grigorecosmin]

Very nice video. Can you do one about Themida?

[@jstrosch]

I’ll add it to my content list :) Thanks for the idea/suggestion

[@evanmartin2]

Re the question at 6:40: At least in a program I was looking at, the reason for the multiple UPX1/UPX2 sections is for different flags on those sections -- UPX1 was marked executable and UPX2 was not.

[@evanmartin2]

(Sorry, still watching the video...) You can see this at 7:15 that the sections have different flags.

[@leadhigh7]

Thank you for your awesome video. Can you post the themida packed version one?

[@jstrosch]

This video only covers UPX - unless I've forgotten a part of it... :) Can you remind me where I mention that?

[@TheHacktooth]

nice video!, im new on reverse eng. and i try to crack/keygen a crackme, it is was packed with upx, and custom encryption.

[@jstrosch]

Interesting - did you figure it out?

[@letrung3249]

Great explanation ! Thx a lot!

[@jstrosch]

You are welcome!

[@johngotek]

how to fix not showing hello world after dumping using scylla ?

[@jstrosch]

Generally after you DUMP with Scylla, then you want to FIX DUMP. This will resolve the import table. If that doesn’t correct any issues, there is likely something else going on. I would ensure that you dumped at the OEP and, if not, try again.

[@MarkedUserName]

Could you make an x64 tutorial please?

[@jstrosch]

Do you mean in general, such as an x64 assembly course?

[@mugosquero]

Scylla was a thing in Prison Break, so I pronounce it the same as how the show does.

[@jstrosch]

ah, interesting. I've looked it up a dozen times now but I always forget... I guess at this point I should just pick a pronunciation and stick with it