> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2024/reverse-engineering/packer-medium.md).

# packer (Medium)

<figure><img src="/files/ZaqlgdDW9YeDlYq5zvCA" alt=""><figcaption></figcaption></figure>

***

Once we downloaded it and run strings, we can see a big hint.&#x20;

<figure><img src="/files/Xcn6eO8tYnXexEX392E7" alt=""><figcaption></figcaption></figure>

The UPX at the top essentially means this file was packed by UPX.

> **UPX** is an advanced executable file compressor. UPX will typically reduce the file size of programs and DLLs by around 50%-70%, thus reducing disk space, network load times, download times and other distribution and storage costs.

If we search up how to unpack a UPX file, we get to this website.

{% embed url="<https://0xh3xa.com/defensive/unpack-upx/>" %}

<figure><img src="/files/Fe3euOV5dpCMmNUZmqVs" alt=""><figcaption></figcaption></figure>

We quite literally just run the command except replace the file names. Next I ran strings on the unpacked file.

<figure><img src="/files/xdcgUhLGM6hCQRUk0kEf" alt=""><figcaption></figcaption></figure>

It gives us the flag, and then we run it through a cipher identifier.&#x20;

<figure><img src="/files/lp0T41FCtvzTYxjSUmOa" alt=""><figcaption></figcaption></figure>

We then get our flag of "picoCTF{U9X\_UnP4ck1N6\_B1n4Ri3S\_e190c3f3}"