Part of the motivation for working on my thesis titled "
Pandora's Bochs: Automatic Unpacking of Malware" was to write a publicly available and open source unpacker for runtime-packed executables, so I had originally planned to polish my code, write up better documentation and release it to the public. However, since handing in my thesis, 6 months passed and I have still not found the time to do so. I do not know when that time will come, so I decided to at least release the latest snapshot to the public. It will probably be non-trivial to set up outside of its original development environment, but it might be useful to somebody. Feel free to pester me with flames or questions.
A slightly modified version of
Bochs with a
Python instrumentation interface and instrumentation code that attempts to supervise processes of a Windows XP SP2 guest system can be found
here. The instrumentation code logs instrumentation events to an
SQLite3 database. Additionally, the address space of a supervised process is dumped to the database, when execution of a modified memory region (indicating execution of newly unpacked code) is detected.
A tool that attempts to reconstruct valid PE images from these databases can be found
here. It can also do other stuff I have long forgotten.
Like Bochs, my additions to it are released under the LGPL.
