Post #2158447
2026-04-23 02:46 UTC
Unfortunately, I was so focused on how nifty this was that I overlooked the other reason to care about unpacking, which is loading the program in a tool like Ghidra. And for that I really do need an exe file.
Replies (1)
-
@evmar@inuh.net 2026-04-23 02:53
In any case, the flow looks like this: $ tc --exe chillin.exe --out exe/chillin-unpack ... WARN tc/src/traverse.rs:40 omitting 004085dd: block appears zero-filled (This shows the code jmp'd to 004085dd, but there was no code there -- that's where the unpacked code starts.) Then I can hand-write a file that provides that function, where it re-invokes the compiler: https://github.com/evmar/theseus/blob/9e2b135af2c32df73f0965c4f5f5159432fb80fe/exe/chillin-unpack/src/externs.rs Which means the whole do_unpack function ends up relatively tiny: https://github.com/evmar/theseus/blob/9e2b135af2c32df73f0965c4f5f5159432fb80fe/exe/chillin-unpack/src/main.rs