티스토리 뷰
The UPX Hacker's Guide
======================
Foreword
--------
The precompiled UPX versions are linked against the NRV compression
library instead of the UCL library. Using the same compression algorithms,
NRV achieves a better compression ratio. NRV is not publicly
available, though, and probably never will be.
While you may be disappointed that you don't have access to the
latest state-of-the-art compression technology this is actually
a safe guard for all of us. The UPX source code release makes
it very easy for any evil-minded person to do all sort of bad
things. By not providing the very best compression ratio it is much
more difficult to create fake or otherwise disguised UPX versions (or
similar trojans), as any end user will notice when the compression
has gotten worse with a new "version" or "product".
Finally please be aware that you now have your hands on the source
code of the most sophisticated executable packer ever.
Let's join our forces to make it even better :-)
Share and enjoy,
Markus & Laszlo
Introduction
------------
Welcome to the UPX source code release!
UPX is not a toy for kids. Apart from basic knowledge about executables
and data compression you will need to be firm in C++, assembler,
Perl and Makefiles. Probably some other things as well.
If you can't manage to compile it then the sources are
probably not for you. Don't email us for help.
The authors use Linux for development. You might want to as well.
Short overview
--------------
The UPX source code consists of two mainly independent parts:
1) The src/stub directory contains the decompression stubs that
will get added to each compressed executable.
The stubs are mainly written in assembler and get "compiled"
into ordinary C header files.
2) The src directory contains the actual packer sources. The stubs
are #included by the individual executable format handlers.
Prerequisites
-------------
- first of all you need to build the UCL compression library
http://www.oberhumer.com/opensource/ucl/
Tools needed to build/modify the UPX sources
--------------------------------------------
- A C++ compiler supporting inner classes, templates, exceptions
and RTTI.
- GNU make 3.81 or better
To compile the packer sources
-----------------------------
Set the environment variable UPX_UCLDIR to point to your
UCL build directory, e.g.
set UPX_UCLDIR=c:\src\ucl-1.03 (DOS / Windows)
export UPX_UCLDIR=$HOME/local/src/ucl-1.03 (Unix)
Set the environment variable UPX_LZMADIR to point to your
to your unpacked lzma443.tar.bz2 source directory, e.g.
export UPX_LZMADIR=$HOME/local/src/lzma-4.43 (Unix)
Finally type
make
If you want to modify the stub sources you'll also need
-------------------------------------------------------
- Perl & Python
- A number of cross-assemblers and cross-compilers - precompiled
binaries for i386-linux hosts are available from
http://sourceforge.net/project/showfiles.php?group_id=2331
Misc. notes
-----------
As the docs say: UPX is a portable, extendable and endian neutral
program, so if you want to add some new stuff, try not to break these
nice properties.
- Use the types LE16, LE32, BE16 and BE32 for fields in file headers.
- Use [sg]et_[bl]e(16|32) for getting/setting values in the data
stream.
- Use gcc extensions and other compiler specific stuff only through
macros.
***
Some conventions:
- follow our coding style
- indent level = 4
- expand all tabulators
- Use throwSomeException() functions instead of throw SomeException():
this makes the code shorter if used often.
***
Patches/Contributions
- Please send us bug fixes/contributions only using
diff -u oldfile newfile
or
diff -uNr olddirectory newdirectory
# vi:ts=4:et
'IT > 프로그래밍' 카테고리의 다른 글
EML 파일의 문법 >> RFC822: Standard for ARPA Internet Text Messages (0) | 2008.11.05 |
---|---|
[리서치] 공개 스팸 메일 필터링 관련 프로그램 (on during ~) (2) | 2008.11.05 |
A File Checksum Shell Menu Extension Dll By Jeffrey Walton (0) | 2008.07.18 |
Creating a Child Process with Redirected Input and Output [펌 msdn] (0) | 2008.07.17 |
호출 규약 ( Calling Convension ) [펌 synch3d.com] (0) | 2008.07.08 |
- Total
- Today
- Yesterday
- 지루박멸연구센타
- 열정의 힘을 믿는다
- Le4rN TO Cr4cK
- 디버깅에관한모든것(DebugLab)
- sysinternals
- FoundStone
- hashtab
- 보안-coderant
- 디바이스드라이버 개발자 포럼
- dualpage.muz.ro
- osronline.com - 드라이버 관련 정보 사이트
- NtInternals - NativeAPI Refere…
- pcthreat - spyware 정보 제공
- rootkit.com - 루트킷 관련 정보
- www.ntinternals.net
- WINE CrossRef. - source.winehq…
- tuts4you
- hex-rays
- idapalace
- idefense
- immunityinc
- threatexpert
- hdp.null2root.org
- www.crackstore.com
- crackmes.de
- www.who.is
- www.cracklab.ru
- community.reverse-engineering.…
- video.reverse-engineering.net
- SnD
- 클레이 키위
- reversengineering.wordpress.co…
- www.openrce.org
- www.woodmann.com
- PEID.Plusins.BobSoft
- roxik.com/pictaps/
- regexlib.com
- spyware-browser.com
- www.usboffice.kr
- regulator
- www.txt2re.com
- ietab.mozdev.org
- zesrever.xstone.org
- www.heaventools.com/PE-file-he…
- www.heaventools.com
- www.innomp3.com
- 울지않는벌새
- exetools.com-forum
- exetools.com
- utf8 conv
- robtex - IP trace
- onsamehost - same IP sites
- JpopSuki
- jsunpack.jeek.org
- wepawet.iseclab.org
- www.jswiff.com
- www.hackeroo.com
- winesearcher.co.kr
- khpga.org
- malwareurl.com
- anubis.iseclab.org
- www.crummy.com-eautifulSoup
- malwarebytes.org/forums
- bbs.janmeng.com
- blackip.ustc.edu.cn
- eureka.cyber-ta.org
- exploit-db.com
- hai
- 다올저축은행
- 주식
- 공공인프라
- INVOICE
- CriticalSection
- 주식트래이딩
- SBI저축은행
- 자동트래이딩
- 피봇
- ChatGPT
- 맥쿼리인프라
- PIR
- 주택구매력지수
- systemd
- 신한저축은행
- 사회간접자본
- ROA
- Pivot
- 시스템트래이딩
- 군함도
- 레고랜드
- logrotate
- ElasticSearch
- ubuntu
- 전세매매지수
- 매매가격지수
- O365
- 미국주식
- 실시간트래이딩
일 | 월 | 화 | 수 | 목 | 금 | 토 |
---|---|---|---|---|---|---|
1 | 2 | 3 | 4 | 5 | 6 | 7 |
8 | 9 | 10 | 11 | 12 | 13 | 14 |
15 | 16 | 17 | 18 | 19 | 20 | 21 |
22 | 23 | 24 | 25 | 26 | 27 | 28 |
29 | 30 | 31 |