/unpack

description: Detect and remove binary packing/protection
allowed-tools: Bash, Read, Write, Glob, Grep, AskUserQuestion
argument-hint: <path-to-binary>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Packer Detection & Unpacking

Parse `$ARGUMENTS` to get the binary path.

Step 1 — Identify Packing

1. Entropy analysis:

   r2 -qc 'iS' <binary>

Sections with entropy > 7.0 are likely packed.

2. File identification:

   file <binary>

3. Known packer signatures:

• **UPX**: `UPX0`, `UPX1` sections, or `UPX!` magic at offset
• **ASPack**: `.aspack`, `.adata` sections
• **Themida/WinLicense**: `.winlicense`, `.themida` sections
• **VMProtect**: `.vmp0`, `.vmp1` sections
• **Enigma**: `.enigma` section
• **.NET Reactor**: `.reacto` section
• **Confuser**: Garbled section names in .NET

Step 2 — Attempt Unpacking

**If UPX detected:**

mkdir -p extracted
upx -d <binary> -o extracted/unpacked-<binary-name>

Verify the unpacked file:

file extracted/unpacked-<binary-name>
r2 -qc 'iS' extracted/unpacked-<binary-name>

**If other packer:** Document the packer type and suggest manual approaches:

• **ASPack**: Try generic unpackers or dump from memory
• **Themida/VMProtect**: Requires dynamic unpacking (run under debugger, dump at OEP)
• **.NET obfuscation**: Use `/dotnet` with de4dot
• **Custom packer**: Use Frida for runtime memory dumping

Ask the user which approach to take:

AskUserQuestion: The binary is packed with <packer>. Options:
1. Attempt automated unpacking
2. Dynamic memory dump (requires wine + frida)
3. Skip unpacking, analyze packed binary
4. Manual approach (provide guidance)

Step 3 — Verify Unpacked Binary

1. Check that the unpacked file is a valid PE:

   file extracted/unpacked-<binary-name>

2. Compare entropy before/after:

   r2 -qc 'iS' extracted/unpacked-<binary-name>

3. Verify imports are now visible:

   r2 -qc 'ii' extracted/unpacked-<binary-name>

Step 4 — Re-analyze

Suggest running `/analyze` on the unpacked binary for full analysis.