Unpacking Protected Binaries

Static unpacking is a trap for anything beyond UPX. The reliable method is to let the program unpack itself, then take the result out of memory. Almost every protector, however sophisticated, must eventually produce executable code in a readable page — that moment is what you are waiting for.

Run protected samples only in a contained environment; see analyzing-malware.

When to Use

• binwalk -E shows uniformly high entropy across most of the file
• The import table has a handful of entries (LoadLibrary, GetProcAddress)
• Section names are absent, random, or UPX0/.themida/.vmp0
• Disassembly shows a small stub and one large data blob
• A tool reports the file is packed, or analysis finds essentially no code

When NOT to Use