node/lib/metasm/samples/dump_upx.rb
# loads the file
# find the oep by disassembling
# run it until the oep
# dump the memory image
loads the file
find the oep by disassembling
run it until the oep
dump the memory image
loads the file find the oep by disassembling run it until the oep dump the memory image
def breakpoint_callback
		puts 'breakpoint hit !'
		dump = LoadedPE.memdump @dbg.memory, @baseaddr, @oep, @iat
		dump.sections.each { |s| s.characteristics |= ['MEM_WRITE'] }
		dump.encode_file @dumpfile, 'exe', false
		puts 'dump complete'
	ensure
		@dbg.kill
	end
def breakpoint_callback puts 'breakpoint hit !' dump = LoadedPE . memdump @dbg . memory , @baseaddr , @oep , @iat dump . sections . each { | s | s . characteristics |= [ 'MEM_WRITE' ] } dump . encode_file @dumpfile , 'exe' , false puts 'dump complete' ensure @dbg . kill end
loads the file
find the oep by disassembling
run it until the oep
dump the memory image
loads the file find the oep by disassembling run it until the oep dump the memory image
# dump the process # create a genuine PE object from the memory image # the UPX loader unpacks everything in sections marked read-only in the PE header, make them writeable # write the PE file to disk # as UPX strips the relocation information, mark the exe to opt-out from ASLR # kill the process