4

I have an executable file that is not lending itself for disassembling or decompiling well as usual/expected.

file and ldd are giving an output different than the usual:

$ file exe_file
exe_file: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), statically linked, stripped

$ ldd exe_file
    not a dynamic executable

strings is also giving hints something is off:

$strings exe_file
UPX!
.....
PROT_EXEC|PROT_WRITE failed.
$Info: This file is packed with the UPX executable packer http://upx.sf.net $
$Id: UPX 3.91 Copyright (C) 1996-2013 the UPX Team. All Rights Reserved. $

Also:

$ ls -la exe_file
-rwxr-xr-x 1 root root 59896 Jan 22 15:26 exe_file

What is happening?

  • 2
    No mystery. It is a UPX-packed binary. Packed binaries in many cases appear to the file command as a statically linked binary. – fpmurphy Jan 24 '18 at 4:46
  • @fpmurphy1 I came across it in malware a couple of weeks ago and albeit I recognised it for what it is, I was not aware of such technology since DOS time when I was a very active assembly programmer. The static linked binary bit here is more to document it for others. Have you really searched for UPX here? There were only vague references to it. I lost maybe 1h researching the subject. – Rui F Ribeiro Jan 24 '18 at 11:30
  • Packers and compressors, of which there are a large number, are subjects that are discussed in some detail in any decent malware analysis course. – fpmurphy Jan 24 '18 at 16:13
  • @fpmurphy1 I knew that from old times, and was investigating it for Linux after someone asked me to investigate a malware problem, and I found it was packed. Fascinating stuff for an old assembly afficionado. I have not dealt with such a low level for a while, only that recently had a technical challenge where I reengineered a couple of small binaries, and I enjoyed the challenge a lot. – Rui F Ribeiro Jan 24 '18 at 16:20
5

From the telltales signatures, we are dealing with a packed UPX executable file.

UPX is a free, portable, extendable, high-performance executable packer for several executable formats.

Usually UPX is used to pack/mask binaries/malware/viruses as it's signatures/core are whitelisted in most AV solutions.

Be aware that in some malware executable files, UPX can be the outer layer, and you may have another "inner" packer of other packing/compression technology after "unpacking" the UPX layer.

To unpack the binary, it is necessary to install upx.

Installing UPX in MacOS using MacPorts:

sudo port install upx

Installing UPX in Debian and derivates:

sudo apt-get install upx-ucl

To unpack the executable binary file:

upx -d exe_file

To pack it:

upx exe_file

For comparison, after unpacking exe_file with:

upx -d exe_file

We rerun the commands in the question and the results are quite different:

$ file exe_file
exe_file: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=3c233e12c466a83aa9b2094b07dbfaa5bd10eccd, stripped

$ ldd exe_file
    linux-vdso.so.1 (0x00007ffd431d3000)
    libselinux.so.1 => /lib/x86_64-linux-gnu/libselinux.so.1 (0x00007f7f7fb7d000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f7f7f7de000)
    libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007f7f7f56b000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f7f7f367000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f7f7ffc6000)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f7f7f14a000)

# ls -la exe_file
-rwxr-xr-x 1 root root 130736 Jan 22 15:26 exe_file

related question Understanding what a Linux binary is doing

  • 1
    If an unpacker utility is not available (which is usually the case), the general methodology is to use your debugger to find the OEP, dump the process memory, fix up the segments, entry point, etc. so you have a unpacked executable binary – fpmurphy Jan 24 '18 at 4:51
  • @RuiFRiberio. So you ask a question and immediately answer the question? Why ask the question in the first place? – fpmurphy Jan 24 '18 at 4:59
  • 3
    @fpmurphy1 answering your own question is completely acceptable; in fact SE sites provide an answer field alongside the question field when you ask a question. I’m guessing Rui realised there wasn’t much about unpacking UPX on this site when he wrote this great answer, and thought it would be worth writing something... The point isn’t to ask a question (Rui obviously knew the answer), it’s to provide an answer to a potentially-useful question for the benefit of others. – Stephen Kitt Jan 24 '18 at 5:37
  • @StephenKitt Comments should let me tag two people. Answer follows in the next comment. – Rui F Ribeiro Jan 24 '18 at 9:45
  • @fpmurphy1 I have got hundreds of questions where I answer them. Even Jon Skeet has them too, in case you have not noticed. I answer my own questions for the benefit of others and myself. My memory is not what it used to be, and it is nice to have these DB of knowledge in the cloud. I also am using this answer as an anchor to a bigger answer because I mention packers there, and found only vague references to them in Unix&Linux. Finally, I was finally with the technology but had to research outside of Unix&Linux how to dealt with it with MacPorts and Debian, and hence the post. (continued) – Rui F Ribeiro Jan 24 '18 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.