Unpacking WinUpack 0.39 with Ollydbg 1.10

Question

I am new to reverse engineering and I am trying to unpack an executable packed with WinUpack 0.39.

After the packing I launched the executable and it worked fine.

When I run it in Ollydbg 1.10 after few instructions it gives me an error of Access Violation. I tried shift-f9 but the exception handler can't deal with this exception.

The error occurs in the line at address 0036FC1A You can see the image of OllyDbg here

How can I deal with this? Thank you for the answer

Answer 1

Assuming that you are now trying to unpack the WinUpack-packed binary using OllyDbg...

Finding the OEP in a WinUpack-packed binary is very difficult. It is in the middle of the unpacking stub and jumps a relatively short distance, so finding the tail jump is difficult.

The best way I have found to find the tail jump is to set a breakpoint on GetProcAddress and then single step until you find the tail jump.

See https://www.aldeid.com/wiki/Category:Digital-Forensics/Computer-Forensics/Anti-Reverse-Engineering/Packers/WinUpack for more information.