Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Failed to unpack: IAT unwrapping failed #106

Open
greenozon opened this issue Sep 9, 2023 · 0 comments
Open

Failed to unpack: IAT unwrapping failed #106

greenozon opened this issue Sep 9, 2023 · 0 comments

Comments

@greenozon
Copy link

c:\Temp>unlicense  GET1.exe --verbose
←[1;32mINFO←[0m - Detected packer version: 3.x
←[38;20mDEBUG - Probed .text section at (0x1000, 0x31c000)←[0m
←[1;36mfrida-agent←[0m: Setting up OEP tracing for "GET1.exe"
←[1;36mfrida-agent←[0m: Exception handler registered
←[1;36mfrida-agent←[0m: OEP found (thread #412): 0x12121b8
←[1;32mINFO←[0m - OEP reached: OEP=0x12121b8 BASE=0x1210000 DOTNET=False
←[1;32mINFO←[0m - Looking for the IAT...
←[38;20mDEBUG - Exports count: 12299←[0m
←[1;32mINFO←[0m - Performing linear scan in data sections...
←[38;20mDEBUG - Looking for the IAT at (0x1211000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x152d000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 50←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155c000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155d000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 4←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155e000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x21c for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1562000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 88←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1563000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 53←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 2←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1564000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 92←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1579000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15ba000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 53←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 2←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bb000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x34c for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bc000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 3←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bd000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 57←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15cb000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1bd9000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x3cc for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1fa1000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 4←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1210000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 23←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1211000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1212000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1213000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 77←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 3←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1214000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 94←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x153f000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1540000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1541000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1542000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155c000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155d000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 4←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155e000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x21c for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155f000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 100←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1560000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1562000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 88←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1563000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 53←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 2←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1564000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 92←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1565000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 72←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1566000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x2c0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bb000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x34c for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bc000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 3←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bd000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 57←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15be000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x118 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 30←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 2←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bf000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 1←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15c0000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x158 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 14←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 1←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15cb000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15cc000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x110 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 32←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 1←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15cd000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x20 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 92←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 4←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15ce000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x58 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 77←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 4←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1bd9000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x3cc for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1bda000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x70 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 72←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 1←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1bdb000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x10 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 96←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 2←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1bdc000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1fa1000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 4←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[1;32mINFO←[0m - Looking for wrapped imports in code sections...
←[1;32mINFO←[0m - Potential import wrappers found: 4
←[1;32mINFO←[0m - IAT found: 0x155e6a4-0x155e6a4
←[1;32mINFO←[0m - Resolving imports ...
←[31;20mERROR - IAT unwrapping failed←[0m

c:\Temp>

GET1.zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant