RECON2008 talk: 64-bit Imports Rebuilding and Unpacking by Sébastien Doucet (IITAC)

IITAC member Sébastien Doucet gave a talk on 64-bit Imports Rebuilding and Unpacking at RECON2008.

With 64-bit packers and protectors being released, there is presently a growing need to create new tools to facilitate the manual unpacking process and to make it as trivial as it is now for protected 32-bit executables. I’m proposing two brand-new tools: CHimpREC and CHimpREC-64, allowing the spirit of ImpREC to live on under the best possible compatibility with all the x64 versions of the Windows operating system.

This talk is about explaining the inner-workings of coding a 32-bit imports rebuilder and the problems encountered due to the WoW64 environment and Address Space Layout Randomization. Next, is an overview of the differences between the PE and PE32+ formats and their impact on porting CHimpREC to 64-bit. Finally, 2 or 3 short live unpacking sessions with different examples of 64-bit packers and how trivial it has become to deal with them with the help of CHimpREC-64.

IITAC - Sponsor of the RECON conference! Free IDA Pro training!

RECON is a computer security conference being held in Montreal. The conference offers a single track of presentations over the span of three days. RECON also offers a variety of technical training courses that take place just before the conference dates. The conference is 13-15 June 2008.

IITAC is a sponsor of the conference in Canada, Montréal. IITAC will give a free lunch workshop on IDA Pro during the conference!