Coding an UPX Unpacker

[Ksbunker]

I have no troubles manually unpacking UPX packed programs.

But I want to take this one step further just for my development, and see if I can write a generic unpacker.

How would one go about doing so?

Mapfile to memory... read section names, if "UPX" found cont. else not UPX, quit.

1. CreateProcess with debug privs?
2. bpm kernel32.loadlibrary

;esp = return EIP
;esp+4 = param 1

3. jmp [esp]
4. Search for E9h XX XX XX XX ....to OEP???

Anyway, you see what I mean, cheers.

[detten]

Isn't the UPX source code available on the web? You could have a look at how the "upx -d" option works.

http://upx.sourceforge.net/download/upx-3.03-src.tar.bz2 (C++)

Otherwise take a look at this source code for some hints :

http://www.exetools.com/forum/showthread.php?t=1326 (MASM)