Reversing.kr Easy Unpack Writeup

Environment

• Host OS: Kali linux 2018.4
• Guest OS: Windows 7 Service Pack 1
• Virtualization: Virtualbox 5.2.22
• PE packer/analyzer: PEiD v0.95

Explanation

Reversing.kr is a website which has some of reverse engineering challenges. This is a write-up of Easy Unpack on that website.

Solution

1. Reading the ReadMe.txt

As we open the readme.txt, what we can see is following message. Sounds like we have to figure out which address is the Original Entry Point.

2. Running the app

When we run the app, we have a small dialogue Clicking does not work for anything

3. Finding an entry point

We can find the OEP easily with a software “PEiD”. After opened Easy_UnpackMe.exe with “PEiD”, click “->” button to open the menu. Then, proceed like

Plugins -> PEiD Generic Unpacker

With this plugin, we can find the OEP. According to this information, the key of this challange is “00401150”.