At the end of our BlackHat presentation on which we unveiled our TitanEngine project we promised to keep supporting it and to publish one unpacker demo per week. And this was true since our first update release for TitanEngine contained quite a few samples.

But since the next update isn't all that close we will stick to our word and publish and blog about the samples ReversingLabs itself contributes. In that spirit we are revisiting the packer we created for mPack ages ago.
So why is mPack interesting? Just because we haven't yet published a source for unpacker that uses overlay to store the compressed file. Interested? Read on...

Ovelay is by definition a piece of data appended to the end of the PE file. In this case that appended data is a compressed executable which sounds logical since we know that mPack was written in Delphi as a proof of concept packer, and since overlay packing is the most simplest form of packing it was used here. The trouble with this is that the compression method weren't documented so we need to "guess" what kind of compression was used and how it was implemented. Which is the fun part of reverse engineering.