UPX unpacking seems bogus even for simple exe

Paolo Di Prodi <[email protected]>
Newsgroups gmane.comp.security.virus.clamav.devel
Message-ID <FC5CCDEED5F71740BD0C7BDDBD3001F218C13E5D60@kestrel.london.contextis.co.uk>
Hello all,
I am developing extensions for Clamav (at least that's my objective!) and was doing some preliminary tests with UPX.
This is my test procedure:
1) compile a simple exe on windows + mingw with one main call function and no stdout: clean.exe
2)  upx clean.exe -o clean.upx.exe
3) run clamav and retrieve the unpacked file: 

LibClamAV debug: EntryPoint offset: 0x14d0 (5328)
LibClamAV debug: Bytecode executing hook id 259 (1 hooks)
LibClamAV debug: Bytecode: no logical signature matched, no bytecode executed
LibClamAV debug: UPX/FSG/MEW: empty section found - assuming compression
LibClamAV debug: UPX: Looks like a NRV2B decompression routine
LibClamAV debug: UPX: UPX1 seems skewed by 21 bytes
LibClamAV debug: UPX: PE structure rebuilt from compressed file
LibClamAV debug: UPX: Successfully decompressed
LibClamAV debug: UPX/FSG: Decompressed data saved in /var/tmp/clam/clamav-6707cc60ae0369dcc51b58d58af8bbdf

4) attempt to run the unpacked file getting a massive page fault (tested both on wine and windows non virtual machine) see output on email bottom.

My question: is this a normal behavior? I was kind of expecting a clean dumped file, because I have to do some static analysis on the dumped output.
I have put the test files on this share folder in case somebody wants to replicate my output:
https://www.dropbox.com/sh/uzvzilslhlop8jv/wyDr1qe8Y6



Clam version (installed from apt-get)
ClamAV 0.97.8/17955/Fri Oct 11 03:44:05 2013


Stack trace unpacked follows:

wine clean.unpacked.exe 
wine: Unhandled page fault on read access to 0x00006250 at address 0x6250 (thread 0009), starting debugger...
Unhandled exception: page fault on read access to 0x00006250 in 32-bit code (0x00006250).
Register dump:
 CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b
 EIP:00006250 ESP:0060fe54 EBP:0060fe88 EFLAGS:00010212(  R- --  I   -A- - )
 EAX:00000000 EBX:7b894ff4 ECX:0060fef0 EDX:0060fef0
 ESI:7ffdf000 EDI:00401280
Stack dump:
0x0060fe54:  00401290 00000001 f7693a2e 00000000
0x0060fe64:  00000000 00000000 00000000 00000000
0x0060fe74:  7b859ddc 7ffdf000 7bc4bd4a 7b894ff4
0x0060fe84:  7ffdf000 0060fec8 7b85b04f 7ffdf000
0x0060fe94:  00401280 00000000 00000000 00000000
0x0060fea4:  00000000 00000000 00000000 00000000
000c: sel=0067 base=00000000 limit=00000000 16-bit r-x
Backtrace:
=>0 0x00006250 (0x0060fe88)
  1 0x7b85b04f in kernel32 (+0x4b04e) (0x0060fec8)
  2 0x7bc71d90 call_thread_func_wrapper+0xb() in ntdll (0x0060fed8)
  3 0x7bc7486d call_thread_func+0x7c() in ntdll (0x0060ffa8)
  4 0x7bc71d6e RtlRaiseException+0x21() in ntdll (0x0060ffc8)
  5 0x7bc49f4e call_dll_entry_point+0x61d() in ntdll (0x0060ffe8)
0x00006250: -- no code accessible --
Modules:
Module	Address			Debug info	Name (19 modules)
PE	  400000-  40d000	Deferred        clean.unpacked
ELF	7b800000-7ba29000	Dwarf           kernel32<elf>
  \-PE	7b810000-7ba29000	\               kernel32
ELF	7bc00000-7bcc3000	Dwarf           ntdll<elf>
  \-PE	7bc10000-7bcc3000	\               ntdll
ELF	7bf00000-7bf04000	Deferred        <wine-loader>
ELF	7ed47000-7ed66000	Deferred        libtinfo.so.5
ELF	7ed66000-7ed88000	Deferred        libncurses.so.5
ELF	7efa1000-7efbb000	Deferred        libnsl.so.1
ELF	7efbb000-7efe7000	Deferred        libm.so.6
ELF	7efe7000-7eff4000	Deferred        libnss_files.so.2
ELF	7eff4000-7f000000	Deferred        libnss_nis.so.2
ELF	f74a2000-f74ab000	Deferred        libnss_compat.so.2
ELF	f74ac000-f74b1000	Deferred        libdl.so.2
ELF	f74b1000-f765a000	Deferred        libc.so.6
ELF	f765b000-f7676000	Deferred        libpthread.so.0
ELF	f768f000-f77d1000	Dwarf           libwine.so.1
ELF	f77d3000-f77f5000	Deferred        ld-linux.so.2
ELF	f77f5000-f77f6000	Deferred        [vdso].so
Threads:
process  tid      prio (all id:s are in hex)
00000008 (D) Z:\home\epokh\Documents\Cyclomatic\clean.unpacked.exe
	00000009    0 <==
0000000e services.exe
	0000001f    0
	0000001e    0
	00000018    0
	00000017    0
	00000015    0
	00000010    0
	0000000f    0
00000012 winedevice.exe
	0000001c    0
	00000019    0
	00000014    0
	00000013    0
0000001a plugplay.exe
	00000020    0
	0000001d    0
	0000001b    0
00000021 explorer.exe
	00000022    0

_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.