node/lib/metasm/samples/dump_upx.rb
# disassemble the upx stub to find a cross-section jump (to the real entrypoint)
disassemble the upx stub to find a cross-section jump (to the real entrypoint)
disassemble the upx stub to find a cross - section jump ( to the real entrypoint )
def find_oep(pe)		
		dasm = pe.disassemble_fast_deep 'entrypoint'
		return if not jmp = dasm.decoded.find { |addr, di|
			next if not di.block_head?
			b = di.block
			next if b.to_subfuncret.to_a.length != 0 or b.to_normal.to_a.length != 1
			to = b.to_normal.first
			next if not s = dasm.get_section_at(to)
			next if dasm.get_section_at(di.address) == s
			true
		}
		dasm.normalize(jmp[1].block.to_normal.first)
	end
def find_oep ( pe ) dasm = pe . disassemble_fast_deep 'entrypoint' return if not jmp = dasm . decoded . find { | addr , di | next if not di . block_head? b = di . block next if b . to_subfuncret . to_a . length != 0 or b . to_normal . to_a . length != 1 to = b . to_normal . first next if not s = dasm . get_section_at ( to ) next if dasm . get_section_at ( di . address ) == s true } dasm . normalize ( jmp [ 1 ] . block . to_normal . first ) end
disassemble the upx stub to find a cross-section jump (to the real entrypoint)
disassemble the upx stub to find a cross - section jump ( to the real entrypoint )
# check only once per basic block # our target has only one follower # ignore jump to unmmaped address # ignore jump to same section # gotcha ! # now jmp is a couple [addr, di], we extract and normalize the oep from there
pe