Vulnerability Development: unpacking UPX or PE-packed binaries

["Karma" <steve () frij com>]

Hi List,

Just interested in how AV R&D companies unpack worms with complex UPX and PE
pack protocols.

Been trying to disect the recent Gaobot variants and getting no where with
my generic UPX-unpacker. Since this is more and more commonly used, I
thought I would be wise to consult the Lists.

Cheers,

Karma