Repository navigation
Arcana v1.0.1
UPX plugin: fix ELF unpacking (filtered code blocks)
UPX applies the x86-64 call/jump filter 0x49 to the code segment of
ELF executables. Filtered blocks were rejected, so the extractor
skipped to a wrong offset and failed. They are now unfiltered (after
reading, before the decoded Adler-32 check, which UPX computes on the
original data for ELF). A reassembled ELF is now named ".unpacked".