UPX unzipping Protection

Directly search for UPX in the file! Enter the words, and then fill them with 00.

However, for such files, you can modify the UPX source code to forcibly decompress them. Currently, we haven't seen examples of dump elf files in memory in Linux.

I wrote a small script.

<?phpif($argc < 2){    print ‘usage: xxoo.php <elf file>‘;    exit(-1);}$file = file_get_contents($argv[1]);if(strlen($file)){    $file = str_replace(‘UPX‘,"\x00\x00\x00",$file);    file_put_contents($argv[1],$file);    echo "OK ~\n";}

It should also be noted that there is still a piece of UPX copyright information in the compressed file, which should be cleared

UPX unzipping Protection