keeping crash after unpacking with upx3.94w

[ruleil]

Hi

I'm facing crash issues after unpack WH2018.exe with upx394w\upx.exe. The unpacked file are keeping crash. Could you give me some suggestion? Thanks.

I have attached the file I'm trying to unpack.

WH2018_pe_fixed2.zip

[stong]

Hi! Thanks for reading my writeup.

I compared your version with the one from the repo. I think your imports data directory size is wrong.

vs

(correct one)

Hope that helps.

[ruleil]

Hi RollSafe

Thanks for your information. This is a pretty good write up. I'm new for CTF and I learned a lot from your write up.

I followed your write up again, and found that the imported directory size is 3B4 after fixing PE structure. So do we need to modify it manually? I didn't see this step within your write up.

Thanks

[stong]

Hi, I took a lot of steps to fix the binary, I probably simply forgot about it. 3b4 is a huge imports size so I must have patched it and neglected to include it in the writeup.

…

On Mon, Sep 10, 2018 at 03:54 ruleil ***@***.***> wrote: Hi RollSafe Thanks for your information. This is a pretty good write up. I'm new for CTF and I learned a lot from your write up. I followed your write up again, and found that the imported directory size is 3B4 after fixing PE structure. So do we need to modify it manually? I didn't see this step within your write up. Thanks — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#3 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AOOiSnalHx2QGXUvPWVZVuv5-HHRTktNks5uZhrMgaJpZM4WgUah> .

[ruleil]

Hi,

Thanks a lot. You are really good at CTF and documentation.

[ruleil]

Hi Sir

Find a solution that can fix the crash issue from this write up: https://github.com/p4-team/ctf/blob/master/2018-08-18-whitehat/re04/README.md

The binary is crashing because of memory misaligment issues, to solve that we have to turn on the Relocation information is stripped from the file bit: