Since automated unpacking is faster and easier to use than manual unpacking, it doesn't work with all packers, encryptors, or protectors. This is because some of them require a manual, custom way to unpack. Some of them have anti-VM techniques or anti-reverse engineering techniques, while others use unusual APIs or assembly instructions that emulators can't detect. In this section, we will look at different techniques for unpacking malware manually.
When it comes to unpacking, many reverse engineers prefer to just execute the original sample, dump the whole process memory, and hope that the unpacked module will be available there. While quite fast, this approach also has multiple disadvantages, such as the following:
- It is possible that the unpacked sample will already be mapped by sections and that the import table will already have been populated, so the engineer will have to change the physical addresses of each section to be equal to the virtual...