AUTOMATED UNPACKING OF PORTABLE EXECUTABLE FILES

摘要

Automated unpacking of a portable executable file includes setting a debugging breakpoint at an original entry point address of a packed portable executable file. A debugging process is executed for the packed portable executable file to obtain a debugged portable executable file in memory. One or more of import address table data and relocation table data are collected during execution of the debugging process for the packed portable executable file. The debugged portable executable file in memory is copied to a storage medium, and the debugging process is terminated.

主权项

1. A computer implemented method comprising:
setting, by a computing device, a debugging breakpoint at an original entry point address of a packed portable executable file; executing, by the computing device, a debugging process for the packed portable executable file to obtain a debugged portable executable file; adding a new section to the debugged portable executable file; and pasting into the debugged portable executable file in the new section one or more of an import address table of the import table data and a relocation table of the relocation table data collected during execution of the debugging process for the packed portable executable file.