UPX is not an executable protector, just a packer, the packer itself provides unpacking functions:
http://upx.sourceforge.net/
If, however, it is modified to not be recognized by the UPX executable, unpacking it is easy as hell.
Open in OllyDbg,
Search for command POPAD, there should be one with a jmp directly after. Breakpoint the JMP.
Run till breakpoint, step once, dump at that address, rebuild imports. _________________
Mutilated lips give a kiss on the wrist of the worm-like tips of tentacles expanding in my mind
I'm fine accepting only fresh brine you can get another drop of this yeah you wish
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum