nozominetworks/upx-recovery-toolAutomates repair of malformed UPX headers in ELF binaries, restoring magic, filesize, blocksize, and overlay fields so standard unpackers can process malware samples.
upx-recovery-tool is a script that aims to repair the most common modifications done by malware creators to ELF UPX-compressed files done to prevent their automatic unpacking with a standard UPX tool.
This tool detects and repairs the following common modifications:
l_magic field of the l_info structure (UPX! magic value)p_filesize and p_blocksize fields of the p_info structureThe script requires the following libraries listed on requirements.txt: