Stub – the main program of an unpacker

So far, we have learned how to develop packer programs. In the previous section, we used an external stub.bin file to generate the master program of the packer stub. In this section, we will describe how to develop the stub in x86.

The following samples are stub.asm source code from the Chapter#8 folder of the GitHub project. To save space, this book only contains highlights of the code. Please refer to the full project for the complete source code.

Figure 8.9 shows the entry point of the hand-written x86 main point of the stub:

Figure 8.9 – The main part of the stub

The main task is split into three parts:

• call decompress_image: This is used to decompress the compressed file-mapping contents of the payload, to fill the text_rwx section to complete the task of restoring the original file-mapping contents, and to act as an application loader to help correct the import table.
• call recover_ntHdr...