Hello all,
I am developing extensions for Clamav (at least that's my objective!) and was doing some preliminary tests with UPX.
This is my test procedure:
1) compile a simple exe on windows + mingw with one main call function and no stdout: clean.exe
2) upx clean.exe -o clean.upx.exe
3) run clamav and retrieve the unpacked file:
LibClamAV debug: EntryPoint offset: 0x14d0 (5328)
LibClamAV debug: Bytecode executing hook id 259 (1 hooks)
LibClamAV debug: Bytecode: no logical signature matched, no bytecode executed
LibClamAV debug: UPX/FSG/MEW: empty section found - assuming compression
LibClamAV debug: UPX: Looks like a NRV2B decompression routine
LibClamAV debug: UPX: UPX1 seems skewed by 21 bytes
LibClamAV debug: UPX: PE structure rebuilt from compressed file
LibClamAV debug: UPX: Successfully decompressed
LibClamAV debug: UPX/FSG: Decompressed data saved in /var/tmp/clam/clamav-6707cc60ae0369dcc51b58d58af8bbdf
4) attempt to run the unpacked file getting a massive page fault (tested both on wine and windows non virtual machine) see output on email bottom.
My question: is this a normal behavior? I was kind of expecting a clean dumped file, because I have to do some static analysis on the dumped output.
I have put the test files on this share folder in case somebody wants to replicate my output:
https://www.dropbox.com/sh/uzvzilslhlop8jv/wyDr1qe8Y6
Clam version (installed from apt-get)
ClamAV 0.97.8/17955/Fri Oct 11 03:44:05 2013
Stack trace unpacked follows:
wine clean.unpacked.exe
wine: Unhandled page fault on read access to 0x00006250 at address 0x6250 (thread 0009), starting debugger...
Unhandled exception: page fault on read access to 0x00006250 in 32-bit code (0x00006250).
Register dump:
CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b
EIP:00006250 ESP:0060fe54 EBP:0060fe88 EFLAGS:00010212( R- -- I -A- - )
EAX:00000000 EBX:7b894ff4 ECX:0060fef0 EDX:0060fef0
ESI:7ffdf000 EDI:00401280
Stack dump:
0x0060fe54: 00401290 00000001 f7693a2e 00000000
0x0060fe64: 00000000 00000000 00000000 00000000
0x0060fe74: 7b859ddc 7ffdf000 7bc4bd4a 7b894ff4
0x0060fe84: 7ffdf000 0060fec8 7b85b04f 7ffdf000
0x0060fe94: 00401280 00000000 00000000 00000000
0x0060fea4: 00000000 00000000 00000000 00000000
000c: sel=0067 base=00000000 limit=00000000 16-bit r-x
Backtrace:
=>0 0x00006250 (0x0060fe88)
1 0x7b85b04f in kernel32 (+0x4b04e) (0x0060fec8)
2 0x7bc71d90 call_thread_func_wrapper+0xb() in ntdll (0x0060fed8)
3 0x7bc7486d call_thread_func+0x7c() in ntdll (0x0060ffa8)
4 0x7bc71d6e RtlRaiseException+0x21() in ntdll (0x0060ffc8)
5 0x7bc49f4e call_dll_entry_point+0x61d() in ntdll (0x0060ffe8)
0x00006250: -- no code accessible --
Modules:
Module Address Debug info Name (19 modules)
PE 400000- 40d000 Deferred clean.unpacked
ELF 7b800000-7ba29000 Dwarf kernel32<elf>
\-PE 7b810000-7ba29000 \ kernel32
ELF 7bc00000-7bcc3000 Dwarf ntdll<elf>
\-PE 7bc10000-7bcc3000 \ ntdll
ELF 7bf00000-7bf04000 Deferred <wine-loader>
ELF 7ed47000-7ed66000 Deferred libtinfo.so.5
ELF 7ed66000-7ed88000 Deferred libncurses.so.5
ELF 7efa1000-7efbb000 Deferred libnsl.so.1
ELF 7efbb000-7efe7000 Deferred libm.so.6
ELF 7efe7000-7eff4000 Deferred libnss_files.so.2
ELF 7eff4000-7f000000 Deferred libnss_nis.so.2
ELF f74a2000-f74ab000 Deferred libnss_compat.so.2
ELF f74ac000-f74b1000 Deferred libdl.so.2
ELF f74b1000-f765a000 Deferred libc.so.6
ELF f765b000-f7676000 Deferred libpthread.so.0
ELF f768f000-f77d1000 Dwarf libwine.so.1
ELF f77d3000-f77f5000 Deferred ld-linux.so.2
ELF f77f5000-f77f6000 Deferred [vdso].so
Threads:
process tid prio (all id:s are in hex)
00000008 (D) Z:\home\epokh\Documents\Cyclomatic\clean.unpacked.exe
00000009 0 <==
0000000e services.exe
0000001f 0
0000001e 0
00000018 0
00000017 0
00000015 0
00000010 0
0000000f 0
00000012 winedevice.exe
0000001c 0
00000019 0
00000014 0
00000013 0
0000001a plugplay.exe
00000020 0
0000001d 0
0000001b 0
00000021 explorer.exe
00000022 0
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
I am developing extensions for Clamav (at least that's my objective!) and was doing some preliminary tests with UPX.
This is my test procedure:
1) compile a simple exe on windows + mingw with one main call function and no stdout: clean.exe
2) upx clean.exe -o clean.upx.exe
3) run clamav and retrieve the unpacked file:
LibClamAV debug: EntryPoint offset: 0x14d0 (5328)
LibClamAV debug: Bytecode executing hook id 259 (1 hooks)
LibClamAV debug: Bytecode: no logical signature matched, no bytecode executed
LibClamAV debug: UPX/FSG/MEW: empty section found - assuming compression
LibClamAV debug: UPX: Looks like a NRV2B decompression routine
LibClamAV debug: UPX: UPX1 seems skewed by 21 bytes
LibClamAV debug: UPX: PE structure rebuilt from compressed file
LibClamAV debug: UPX: Successfully decompressed
LibClamAV debug: UPX/FSG: Decompressed data saved in /var/tmp/clam/clamav-6707cc60ae0369dcc51b58d58af8bbdf
4) attempt to run the unpacked file getting a massive page fault (tested both on wine and windows non virtual machine) see output on email bottom.
My question: is this a normal behavior? I was kind of expecting a clean dumped file, because I have to do some static analysis on the dumped output.
I have put the test files on this share folder in case somebody wants to replicate my output:
https://www.dropbox.com/sh/uzvzilslhlop8jv/wyDr1qe8Y6
Clam version (installed from apt-get)
ClamAV 0.97.8/17955/Fri Oct 11 03:44:05 2013
Stack trace unpacked follows:
wine clean.unpacked.exe
wine: Unhandled page fault on read access to 0x00006250 at address 0x6250 (thread 0009), starting debugger...
Unhandled exception: page fault on read access to 0x00006250 in 32-bit code (0x00006250).
Register dump:
CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b
EIP:00006250 ESP:0060fe54 EBP:0060fe88 EFLAGS:00010212( R- -- I -A- - )
EAX:00000000 EBX:7b894ff4 ECX:0060fef0 EDX:0060fef0
ESI:7ffdf000 EDI:00401280
Stack dump:
0x0060fe54: 00401290 00000001 f7693a2e 00000000
0x0060fe64: 00000000 00000000 00000000 00000000
0x0060fe74: 7b859ddc 7ffdf000 7bc4bd4a 7b894ff4
0x0060fe84: 7ffdf000 0060fec8 7b85b04f 7ffdf000
0x0060fe94: 00401280 00000000 00000000 00000000
0x0060fea4: 00000000 00000000 00000000 00000000
000c: sel=0067 base=00000000 limit=00000000 16-bit r-x
Backtrace:
=>0 0x00006250 (0x0060fe88)
1 0x7b85b04f in kernel32 (+0x4b04e) (0x0060fec8)
2 0x7bc71d90 call_thread_func_wrapper+0xb() in ntdll (0x0060fed8)
3 0x7bc7486d call_thread_func+0x7c() in ntdll (0x0060ffa8)
4 0x7bc71d6e RtlRaiseException+0x21() in ntdll (0x0060ffc8)
5 0x7bc49f4e call_dll_entry_point+0x61d() in ntdll (0x0060ffe8)
0x00006250: -- no code accessible --
Modules:
Module Address Debug info Name (19 modules)
PE 400000- 40d000 Deferred clean.unpacked
ELF 7b800000-7ba29000 Dwarf kernel32<elf>
\-PE 7b810000-7ba29000 \ kernel32
ELF 7bc00000-7bcc3000 Dwarf ntdll<elf>
\-PE 7bc10000-7bcc3000 \ ntdll
ELF 7bf00000-7bf04000 Deferred <wine-loader>
ELF 7ed47000-7ed66000 Deferred libtinfo.so.5
ELF 7ed66000-7ed88000 Deferred libncurses.so.5
ELF 7efa1000-7efbb000 Deferred libnsl.so.1
ELF 7efbb000-7efe7000 Deferred libm.so.6
ELF 7efe7000-7eff4000 Deferred libnss_files.so.2
ELF 7eff4000-7f000000 Deferred libnss_nis.so.2
ELF f74a2000-f74ab000 Deferred libnss_compat.so.2
ELF f74ac000-f74b1000 Deferred libdl.so.2
ELF f74b1000-f765a000 Deferred libc.so.6
ELF f765b000-f7676000 Deferred libpthread.so.0
ELF f768f000-f77d1000 Dwarf libwine.so.1
ELF f77d3000-f77f5000 Deferred ld-linux.so.2
ELF f77f5000-f77f6000 Deferred [vdso].so
Threads:
process tid prio (all id:s are in hex)
00000008 (D) Z:\home\epokh\Documents\Cyclomatic\clean.unpacked.exe
00000009 0 <==
0000000e services.exe
0000001f 0
0000001e 0
00000018 0
00000017 0
00000015 0
00000010 0
0000000f 0
00000012 winedevice.exe
0000001c 0
00000019 0
00000014 0
00000013 0
0000001a plugplay.exe
00000020 0
0000001d 0
0000001b 0
00000021 explorer.exe
00000022 0
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net