From 1b59299de17cfd273d50cdfda992e2a84b45d775 Mon Sep 17 00:00:00 2001 From: Sean LaPlante Date: Wed, 25 Sep 2024 09:42:30 -0400 Subject: [PATCH] UPX: Handle 32-bit binaries that don't have PROT_EXEC|PROT_WRITE --- README.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 14943b8..c280961 100644 --- a/README.md +++ b/README.md @@ -2003,10 +2003,11 @@ Optionally cleanse signatures and traces of UPX: ```shell cat "${BIN}" \ | perl -e 'local($/);$_=<>;s/(.*)(\$Info:[^\0]*)(.*)/print "$1";print "\0"x length($2); print "$3"/es;' \ -| perl -e 'local($/);$_=<>;s/(.*)(\$Id:[^\0]*)(.*)/print "$1";print "\0"x length($2); print "$3"/es;' \ -| perl -e 'local($/);$_=<>;s/(.*)(PROT_EXEC\|PROT_WRI[^\0]*)(.*)/print "$1";print "\0"x length($2); print "$3"/es;' >"${BIN}.tmpupx" -cat "${BIN}.tmpupx" >"${BIN}" -rm -f "${BIN}.tmpupx" +| perl -e 'local($/);$_=<>;s/(.*)(\$Id:[^\0]*)(.*)/print "$1";print "\0"x length($2); print "$3"/es;' >"${BIN}.tmpupx" +mv "${BIN}.tmpupx" "${BIN}" +grep -Eq "PROT_EXEC\|PROT_WRITE" "${BIN}" \ +&& cat "${BIN}" | perl -e 'local($/);$_=<>;s/(.*)(PROT_EXEC\|PROT_WRI[^\0]*)(.*)/print "$1";print "\0"x length($2); print "$3"/es;' >"${BIN}.tmpupx" \ +&& mv "${BIN}.tmpupx" "${BIN}" perl -i -0777 -pe 's/UPX!/\0\0\0\0/sg' "${BIN}" ```