Yours super GiM 17:45:58 CEST 2oo6-o7-o8
If you have seen entry about mistakes in MEW here is similiar about mistakes I've made while developing Upack unpacker: (oh and just to answer: I wasn't doing any imptable fixing).
1. forgeting about updating variable value:
``` do {
if ( (loc_al = (loc_eax&0xff)) + 0xfd > 0xff)
loc_al += 0xfd;
else
loc_al = 0;
loc_eax = (loc_eax&0xffffff00)|(loc_al&0xff);
} while (loc_al >= 7);
```
should be:
``` do {
if ( (loc_al = (loc_eax&0xff)) + 0xfd > 0xff)
loc_al += 0xfd;
else
loc_al = 0;
loc&=0xff;
loc_eax = (loc_eax&0xffffff00)|loc_al;
} while (loc_al >= 7);
```
finally:
``` do {
if ( (loc_al = (loc_eax&0xff)) + 0xfd > 0xff)
loc_al -= 3;
else
loc_al = 0;
loc_eax = (loc_eax&0xffffff00)|loc_al;
} while (loc_al >= 7);
```
2. decrementing wrong variable (ret instead of loc_eax).
3. test x,y
setnz ah
inc ah
was:
``` loc_eax = (loc_eax&0xffff00ff)|((x == y)?0x200:0x100);
```
should be:
``` loc_eax = (loc_eax&0xffff00ff)|((x & y)?0x200:0x100);
```
4. setting variable to 0xb (11) instead of 0x11 (17) [sic! that's why late-night-coding is baaad]
5. forgotten casting
``` *a = b;
```
should be:
``` *(uint32_t *)a = b;
```
since a was byte pointer.
GiM 18:11:22 CEST 2006-2o-o7
Because Upack in contrast with MEW is console tool, I've write small oneliner for Microsoft PowerShell for generating samples for tests:
```PS C:\Upack399> Get-ChildItem samples  | foreach { if (\$_ -ne "Upack.exe") {
C:\Upack399\Upack.exe samples\\$_ "} }
```
I've tested 16 files, results with default settings:
 MEW 11 SE 1.2 Upack 0.399 Succesfully packed 15 16 Succesfully run 10* 12
[*11, but one after running didn't worked and shouted about memory violations]
Update (16:51:o1 CEST 2oo6-o7-o8): Grzegorz Niemirowski suggested ls instead of Get-ChildItem to make it even shorter.
GiM 14:o2:57 CEST 2006-2o-o7
Hi, I've placed small mew-packed package here. This is just for testing purposes.
Michał GiM Spadliński 23:43:54 CEST 2oo6-12-o7
Hi, there, here is small list of different (stupid) mistakes I've made while reverse engineering MEW exe-packer:
``` ret = *(uint16_t *)old_ecx);
old_eax = (old_eax&0xffff0000) | ret;
old_eax -= loc_esi
old_ecx = ret; ```
should be:
` old_ecx = old_eax&0xffff; `
` loc_esi = p[0]&0xff; `
should be:
` loc_esi = *(uint8_t *)(p[0]); `
3. errors in comparisions
• ` while (loc_esi != *old_eax) `
should be:
` while (loc_esi == *old_eax) `
• ` if (lzma48(...)) `
should be:
` if (lzma48(...) != 1) `
4. forget shift:
` *old_eax = var0; `
should be:
` *old_eax = var0 << 4; `
` *old_eax = var0 << 3; `
``` /* and al,0fdh */
` new_edn &= 0xfffffffd; `
` (*(uint32_t *)(..)) `
` (*(uint8_t *)(..)) `