https://www.hruby.xyz/tags/reversing/Recent content in Reversing on _epslnHugoen-usSat, 27 Jun 2026 00:00:00 +0000https://www.hruby.xyz/posts/winhardpacked_writeup/Sat, 27 Jun 2026 00:00:00 +0000https://www.hruby.xyz/posts/winhardpacked_writeup/<p>We are presented with a windows executable. I first ran <code>file</code> to check whether it was somehow mutated or needed patching for some reason.</p> <pre tabindex="0"><code>file WinHardPacked.exe WinHardPacked.exe: PE32 executable for MS Windows 5.00 (console), Intel i386, UPX compressed, 3 sections </code></pre><p>I noticed the executable was compressed with UPX, so I unpacked it before doing anything else.</p> <pre tabindex="0"><code>upx -d WinHardPacked.exe -o unpacked_winhard.exe </code></pre><p>I opened the entrypoint in the decompiler and saw it was referencing a function <code>FUN_0040153d</code>, so I jumped into it:</p>