Skip to content

Arcana v1.0.1

Choose a tag to compare

@RealBurst RealBurst released this 02 Oct 09:27
· 22 commits to main since this release

UPX plugin: fix ELF unpacking (filtered code blocks)

UPX applies the x86-64 call/jump filter 0x49 to the code segment of
ELF executables. Filtered blocks were rejected, so the extractor
skipped to a wrong offset and failed. They are now unfiltered (after
reading, before the decoded Adler-32 check, which UPX computes on the
original data for ELF). A reassembled ELF is now named ".unpacked".