Skip to content

Instantly share code, notes, and snippets.

@trietptm
Forked from mrexodia/upx.py
Created October 21, 2016 15:03
Show Gist options
  • Save trietptm/cd439788c3d57e05de8a3d0305e42b94 to your computer and use it in GitHub Desktop.
Save trietptm/cd439788c3d57e05de8a3d0305e42b94 to your computer and use it in GitHub Desktop.
Unpacking UPX with x64dbgpy
from x64dbgpy.pluginsdk import *
import sys
cip = register.GetCIP()
if memory.ReadByte(cip) != 0x60:
gui.Message("Start at UPX entry point (1:[CIP]==0x60)")
exit(0)
x64dbg.DbgCmdExecDirect("bc")
x64dbg.DbgCmdExecDirect("bphwc")
found = pattern.FindMem(cip, 0x1000, "83 EC ?? E9");
if found == 0:
gui.Message("Could not find pattern!");
exit(0)
debug.SetBreakpoint(found + 3)
debug.Run()
debug.StepIn()
cip = register.GetCIP()
comment.Set(cip, "OEP Found by Python!")
gui.Message("Reached OEP. Use Scylla to dump and restore imports!")
x64dbg.DbgCmdExec("scylla")
@Mafhoom
Copy link

Mafhoom commented Dec 2, 2020

would you please update this for the last UPX?
thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment