Verifying ELF is Packed by UPX on Linux

Question

I do not have zero knowledge about how the ELF format works or how to access its headers and data through code, however I need to check if the ELF compressed (packed) binary file was with UPX for Linux.

Checking the binary with. stringsI saw a line UPX!, so I think I can use it. Hexediting the binary shows a string for a position in binary format. I can consider it part of one of the ELF headers (please correct me if I am wrong). This is a dump:

00000000    .ELF........................4...
00000020    ........4. ...(.................
00000040    ........................@...@...
00000060    @.....................[.UPX!....
00000080    ............T............?d..ELF

I don't know if this looks good, sorry.

Does anyone know how to detect UPX on Linux? If not, how to access the headers and get the string UPX!(header name?)?

I looked at the UPX source code, but it's all C ++, I'm looking for code for this in C, and it's really hard to execute.

Thanks, any help is appreciated.

EDIT: About generosity. They answer, they must give a good example that works, since I tried different approaches, and they do not always work, as an example below.
Thanks you

Answer 1

These are the tests for detecting a compressed UPX file:

>>>>(0x3c.l+0xf8)   string      UPX0 \b, UPX compressed
>>>>(0x3c.l+0xf8)   search/0x140    UPX2
>>>(&0x7c.l+0x26)   string      UPX \b, UPX compressed
>>>&0x26    string      UPX \b, UPX compressed
>>85    string      UPX     \b, UPX compressed

using

man 5 magic

to see how offsets are indicated inside the file.

For example, in your program you should:

• open the file under testing for reading
• go to one of these offsets.
• check if the expected row exists
• repeat until canceled

, 64- Ubuntu UPX , /usr/share/misc/magic:

>>180   string      UPX!        UPX compressed (64-bit)

Answer 2

UPX int PackW32Pe::canUnpack(), , upx -d <file> ( ). , , , UPX. . .

UPX .