Skip to content

Instantly share code, notes, and snippets.

@spnow
Forked from trietptm/upx.py
Created December 22, 2016 11:50
Show Gist options
  • Save spnow/d6022c9823f74dcf1412a7a13a85b0f1 to your computer and use it in GitHub Desktop.
Save spnow/d6022c9823f74dcf1412a7a13a85b0f1 to your computer and use it in GitHub Desktop.
Unpacking UPX with x64dbgpy
from x64dbgpy.pluginsdk import *
import sys
cip = register.GetCIP()
if memory.ReadByte(cip) != 0x60:
gui.Message("Start at UPX entry point (1:[CIP]==0x60)")
exit(0)
x64dbg.DbgCmdExecDirect("bc")
x64dbg.DbgCmdExecDirect("bphwc")
found = pattern.FindMem(cip, 0x1000, "83 EC ?? E9");
if found == 0:
gui.Message("Could not find pattern!");
exit(0)
debug.SetBreakpoint(found + 3)
debug.Run()
debug.StepIn()
cip = register.GetCIP()
comment.Set(cip, "OEP Found by Python!")
gui.Message("Reached OEP. Use Scylla to dump and restore imports!")
x64dbg.DbgCmdExec("scylla")
@Mafhoom
Copy link

Mafhoom commented Dec 2, 2020

would you please update this for Last version of UPX?
thank you

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment