Question

I have a file which is UPX packed. Is there any way I can change the headers and still find it as UPX packed? And how do I unpack it ?
I tried a lot of tutorials and I am fed up as all explain the same method which doesnt work for me.
the same problem is mentioned in the following :
http://www.reteam.org/board/showthread.php?t=2670
I am not a well versed reverse engg.. 🙁 jst a noob .. any ideas will be really helpful.

Answer 1

1. To find the packing, I use PEID, protectionID etc.

2. For correcting the headers, you need to open up the file in a hexeditor and fix the offsets in the binary manually. Then you could use the upx.exe file to decrypt as

   upx -d