I wrote a very in depth and deep diving article about unpacking a heavily encrypted, compressed and obfuscated ELF binary file.
First of all we have to learn how to identify a compressed and packed ELF. We start by checking out the symbol table and right away we see some suspect signs.
We continue with analysing the entropy of the file - a useful tool and trick which is useful for determining if an executable is packed or not.
We dive in head first by scanning for compression signatures.... and find one!
After that we find a function which uses a standard comperssion algorithm at run time. We unpack the file, and the size jumps from 20Mb~ to over 70Mb~! We are onto something...
...
Some byte code surgery and a few patches here and there and we have it! We successfully rebuilt a working unpacked version of the program so now we can analyze it in ghidra.
Even with that finished we are long away from done. All strings are encrypted so we decrypt them and find out how their licensing system works.
noppers•1h ago
First of all we have to learn how to identify a compressed and packed ELF. We start by checking out the symbol table and right away we see some suspect signs.
We continue with analysing the entropy of the file - a useful tool and trick which is useful for determining if an executable is packed or not.
We dive in head first by scanning for compression signatures.... and find one!
After that we find a function which uses a standard comperssion algorithm at run time. We unpack the file, and the size jumps from 20Mb~ to over 70Mb~! We are onto something...
...
Some byte code surgery and a few patches here and there and we have it! We successfully rebuilt a working unpacked version of the program so now we can analyze it in ghidra.
Even with that finished we are long away from done. All strings are encrypted so we decrypt them and find out how their licensing system works.
Check out the tutorial.
https://www.yourdev.net/blog.php?post=unpacking-a-commercial...