Reversing.kr Easy Unpack Writeup
29 Dec 2018Environment
- Host OS: Kali linux 2018.4
- Guest OS: Windows 7 Service Pack 1
- Virtualization: Virtualbox 5.2.22
- PE packer/analyzer: PEiD v0.95
Explanation
Reversing.kr is a website which has some of reverse engineering challenges. This is a write-up of Easy Unpack on that website.
Solution
1. Reading the ReadMe.txt
As we open the readme.txt, what we can see is following message.
Sounds like we have to figure out which address is the Original Entry Point.
2. Running the app
When we run the app, we have a small dialogue Clicking does not work for anything
3. Finding an entry point
We can find the OEP easily with a software “PEiD”.
After opened Easy_UnpackMe.exe with “PEiD”, click “->” button to open the menu.
Then, proceed like
Plugins -> PEiD Generic Unpacker
With this plugin, we can find the OEP.
According to this information, the key of this challange is “00401150”.