3

I have an executable file that is not lending itself for disassembling or decompiling well as usual/expected.

file and ldd are giving an output different than the usual:

$ file exe_file
exe_file: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), statically linked, stripped

$ ldd exe_file
    not a dynamic executable

strings is also giving hints something is off:

$strings exe_file
UPX!
.....
PROT_EXEC|PROT_WRITE failed.
$Info: This file is packed with the UPX executable packer http://upx.sf.net $
$Id: UPX 3.91 Copyright (C) 1996-2013 the UPX Team. All Rights Reserved. $

Also:

$ ls -la exe_file
-rwxr-xr-x 1 root root 59896 Jan 22 15:26 exe_file

What is happening?

Improve this question
4
  • 2
    No mystery. It is a UPX-packed binary. Packed binaries in many cases appear to the file command as a statically linked binary.
    – fpmurphy
    Jan 24, 2018 at 4:46
  • @fpmurphy1 I came across it in malware a couple of weeks ago and albeit I recognised it for what it is, I was not aware of such technology since DOS time when I was a very active assembly programmer. The static linked binary bit here is more to document it for others. Have you really searched for UPX here? There were only vague references to it. I lost maybe 1h researching the subject.
    – Rui F Ribeiro
    Jan 24, 2018 at 11:30
  • Packers and compressors, of which there are a large number, are subjects that are discussed in some detail in any decent malware analysis course.
    – fpmurphy
    Jan 24, 2018 at 16:13
  • @fpmurphy1 I knew that from old times, and was investigating it for Linux after someone asked me to investigate a malware problem, and I found it was packed. Fascinating stuff for an old assembly afficionado. I have not dealt with such a low level for a while, only that recently had a technical challenge where I reengineered a couple of small binaries, and I enjoyed the challenge a lot.
    – Rui F Ribeiro
    Jan 24, 2018 at 16:20

1 Answer 1

Reset to default
5

From the telltales signatures, we are dealing with a packed UPX executable file.

UPX is a free, portable, extendable, high-performance executable packer for several executable formats.

Usually UPX is used to pack/mask binaries/malware/viruses as it's signatures/core are whitelisted in most AV solutions.

Be aware that in some malware executable files, UPX can be the outer layer, and you may have another "inner" packer of other packing/compression technology after "unpacking" the UPX layer.

To unpack the binary, it is necessary to install upx.

Installing UPX in MacOS using MacPorts:

sudo port install upx

Installing UPX in Debian and derivates:

sudo apt-get install upx-ucl

To unpack the executable binary file:

upx -d exe_file

To pack it:

upx exe_file

For comparison, after unpacking exe_file with:

upx -d exe_file

We rerun the commands in the question and the results are quite different: 

$ file exe_file
exe_file: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=3c233e12c466a83aa9b2094b07dbfaa5bd10eccd, stripped

$ ldd exe_file
    linux-vdso.so.1 (0x00007ffd431d3000)
    libselinux.so.1 => /lib/x86_64-linux-gnu/libselinux.so.1 (0x00007f7f7fb7d000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f7f7f7de000)
    libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007f7f7f56b000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f7f7f367000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f7f7ffc6000)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f7f7f14a000)

# ls -la exe_file
-rwxr-xr-x 1 root root 130736 Jan 22 15:26 exe_file

related question Understanding what a Linux binary is doing

Improve this answer
7
  • 1
    If an unpacker utility is not available (which is usually the case), the general methodology is to use your debugger to find the OEP, dump the process memory, fix up the segments, entry point, etc. so you have a unpacked executable binary
    – fpmurphy
    Jan 24, 2018 at 4:51
  • @RuiFRiberio. So you ask a question and immediately answer the question? Why ask the question in the first place?
    – fpmurphy
    Jan 24, 2018 at 4:59
  • 3
    @fpmurphy1 answering your own question is completely acceptable; in fact SE sites provide an answer field alongside the question field when you ask a question. I’m guessing Rui realised there wasn’t much about unpacking UPX on this site when he wrote this great answer, and thought it would be worth writing something... The point isn’t to ask a question (Rui obviously knew the answer), it’s to provide an answer to a potentially-useful question for the benefit of others.
    – Stephen Kitt
    Jan 24, 2018 at 5:37
  • @StephenKitt Comments should let me tag two people. Answer follows in the next comment.
    – Rui F Ribeiro
    Jan 24, 2018 at 9:45
  • @fpmurphy1 I have got hundreds of questions where I answer them. Even Jon Skeet has them too, in case you have not noticed. I answer my own questions for the benefit of others and myself. My memory is not what it used to be, and it is nice to have these DB of knowledge in the cloud. I also am using this answer as an anchor to a bigger answer because I mention packers there, and found only vague references to them in Unix&Linux. Finally, I was finally with the technology but had to research outside of Unix&Linux how to dealt with it with MacPorts and Debian, and hence the post. (continued)
    – Rui F Ribeiro
    Jan 24, 2018 at 9:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .