Automated Unpacking of Portable Executable Files

A computer program product comprising a computer readable medium having a plurality of instructions stored thereon, which, when executed by a processor, cause the processor to perform operations comprising:

• setting a debugging breakpoint at an original entry point address of a packed portable executable file;
• executing a debugging process for the packed portable executable file to obtain a debugged portable executable file in memory;
• collecting one or more of import address table data and relocation table data during execution of the debugging process for the packed portable executable file;
• copying the debugged portable executable file in memory to a storage medium;
• and
• terminating the debugging process.

A system comprising:

• a processor;
• a memory coupled with the processor;
• a first software module executable by the processor and the memory, the first software module configured to set a debugging breakpoint at an original entry point address of a packed portable executable file;
• a second software module executable by the processor and the memory, the second software module configured to execute a debugging process for the packed portable executable file to obtain a debugged portable executable file in memory;
• a third software module executable by the processor and the memory, the third software module configured to collect one or more of import address table data and relocation table data during execution of the debugging process for the packed portable executable file;
• a fourth software module executable by the processor and the memory, the fourth software module configured to copy the debugged portable executable file in memory to a storage medium;
• and
• a fifth software module executable by the processor and the memory, the fifth software module configured to terminate the debugging process.