Package: unipacker
_   _         __  _  __                    _
| | | |       / / (_) \ \                  | |
| | | |_ __  | |   _   | | _ __   __ _  ___| | _____ _ __
| | | | '_ \/ /   | |   \ \ '_ \ / _` |/ __| |/ / _ \ '__|
| |_| | | | \ \   | |   / / |_) | (_| | (__|   <  __/ |
 \___/|_| |_|| |  |_|  | || .__/ \__,_|\___|_|\_\___|_|
              \_\     /_/ | |
                          |_|Un{i}packerMasterDevUnpacking PE files using Unicorn EngineThe usage of runtime packers by malware authors is very common, as it is a technique that helps to hinder analysis.
Furthermore, packers are a challenge for antivirus products, as they make it impossible to identify malware by signatures
or hashes alone.In order to be able to analyze a packed malware sample, it is often required to unpack the binary. Usually this means,
that the analyst will have to manually unpack the binary by using dynamic analysis techniques (Tools: OllyDbg, x64Dbg).
There are also some approaches for automatic unpacking, but they are all only available for Windows. Therefore when
targeting a packed Windows malware the analyst will require a Windows machine. The goal of our project is to enable
platform independent automatic unpacking by using emulation that yields runnable Windows binaries.Fully supported packersASPack: Advanced commercial packer with a high compression ratioFSG: Freeware, fast to unpackMEW: Specifically designed for small binariesMPRESS: Free, more complex packerPEtite: Freeware packer, similar to ASPackUPX: Cross-platform, open source packerYZPackOther packersAny other packers should work as well, as long as the needed API functions are implemented in Un{i}packer. For packers that
aren't specifically known you will be asked whether you would like to manually specify the start and end addresses for emulation.
If you would like to start at the entry point declared in the PE header and just emulate until section hopping is detected,
pressEnterShowcaseWe are humbled to see some active usage of Un{i}packer for research projects, university courses and other resources that teach students about malware obfuscation:Tutorial videobelonging to the Master's course "Malware Analysis and Cyber Threat Intelligence" at the Westphalian University,
demonstrating how to analyze obfuscated malware with Un{i}packerDeepReflect: Paper presenting a tool for localizing and identifying malware
components within a malicious binary. Its dataset relies on a Un{i}packer preprocessing stepBDHunter: Paper describing a system that automatically identifies behavior dispatchers to assist triggering malicious behaviors.
The tool requires unpacked malware samples as input, where the authors propose using Un{i}packerJARV1S Disassembler: Disassembler that uses Un{i}packer as a preprocessing stepAnti-Anti-Virus 2lecture of University of Virginia's "CS 4630: Defense Against the Dark Arts",
using Un{i}packer as an example for unpacking techniquesMastering Malware Analysis: The second edition of this comprehensive guide to malware analysis by
Alexey Kleymenov and Amr Thabet also explains how unpacking and deobfuscation works, mentioning Un{i}packer as a suitable tool for several popular packersIf you are using Un{i}packer for additional projects and would like them featured in this list, we would love to hear from you!UsageNormal installationInstall theYARApackage for your OS, get Un{i}packer from PyPi and start it using the automatically created command line wrapper:pip3 install unipacker
unipackerFor detailed instructions on how to use Un{i}packer please refer to theWiki.
Additionally, all of the shell commands are documented. To access this information, use thehelpcommandYou can take a quick look at Un{i}packer in action in a (german)videoby Prof. Chris DietrichDevelopment mode installationClone the repository, and inside the project root folder activate development mode usingpip3 install -e .Using DockerYou can also use the provided Dockerfile to run a containerized version of Un{i}packer:docker run -it -v ~/local_samples:/root/unipacker/local_samples vfsrfs/unipackerAssuming you have a folder calledlocal_samplesin your home directory, this will be mounted inside the container.
Un{i}packer will thus be able to access those binaries via/root/unipacker/local_samplesRESTful APIA 3rd party wrapper created by @rpgeeganage allows to unpack samples by sending a request to a RESTful server:https://github.com/rpgeeganage/restful4up