Unpacking Strategy

• Static unpacking (rare, easy cases): UPX ships an unpacker — upx -d sample.exe.
• General strategy — let it unpack itself, then dump from memory:
• Run under a debugger in your isolated VM.
• Let the stub decrypt/decompress the real code into memory.
• Find the OEP (Original Entry Point) — where the stub hands control to the real program.
• Dump the process image; fix the imports (IAT reconstruction).
• Tell-tale signs of a packer: tiny import table, high-entropy sections, weird section names (UPX0, .themida), a section that is written then executed.