Skip to content

Commit bd50479

Browse files
authoredFeb 19, 2024
Update README.md
1 parent 1abdf51 commit bd50479

File tree

1 file changed

+23
-1
lines changed

1 file changed

+23
-1
lines changed
 

‎README.md

+23-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,29 @@
11
# InflativeLoading
2-
## Major Update Logs
2+
3+
## Major Update History
4+
In this section, major updates are provided. Major updates do include added supports or features.
35

46
### Added Basic Support For UPX Packed EXE
7+
I slightly modified the code that fixes IAT, because I found some lines of code are unnecessary. After this, InflativeLoading can execute **some UPX packed EXE programs**, including **calc.exe**, **PsExec**. However, only some of packed programs. Firstly, I am not likely to test all possible packing configurations for all tested programs. For the second reason, please continue to read:
8+
9+
For programs that do not have `delayed import directory`, InflativeLoading can execute UPX-packed versions of them. However, unlike unpacked programs, packed programs have all ILT empty.
10+
11+
Take normal calc.exe as an example, ILT and IAT are identical for all modules.
12+
![image](/screenshot/calc_pebear.jpg)
13+
14+
But for the UPX packed calc.exe, ILT is empty for all entries in Import Directory.
15+
![image](/screenshot/packed_calc.jpg)
16+
17+
But if the program has delayed import directory, like Mimikatz, it gets more complex.
18+
19+
For the normal mimikatz.exe, the delayed import directory is as follows:
20+
![image](/screenshot/mimikatz_pebear.jpg)
21+
22+
But for the UPX packed mimikatz.exe, PE Bear is unable to parse it, so do I.
23+
![image](/screenshot/packed_mimikatz.jpg)
24+
25+
26+
527

628

729
## Background

0 commit comments

Comments
 (0)
Please sign in to comment.