Re: Detecting a C translated bound program
- Posted by OtterDad <otter at ful?-moon.c?m> Oct 26, 2007
- 594 views
Pete Lomax wrote: > > OtterDad wrote: > > > Pete Lomax wrote: > > > > The above is completely untested, btw. > On closer inspection it has a UPX0 section in there which changes size and > entry > point every time, didn't realise that. On an equally unsure footing, you may > be able to check for the UPX0 section as an indicator, if eu2c applies upx > then > I'm out of ideas. Anyway, fingers crossed: > > }}} <eucode> > >-- void = seek(fn,#A8) > > void = seek(fn,#178) > >-- if equal(ep,{#10,#0F,#03,#00}) then > > if equal(ep,"UPX0") then > > </eucode> {{{ > Seems to identify bound eu programs for me anyway. > > Regards, > Pete Worked like a champ! Let me pretty up the code and I'll publish the function. Maybe it will come in handy for somebody else. Does it also work with 3.1.1? Thanks again! You saved me much embarrassment. Yours, OtterDad Don't sweat it -- it's not real life. It's only ones and zeroes. Gene Spafford