1

I do have an executable packed file.

I want to detect compression or encryption algorithm dynamic and static ways separatly; of course without signature base way.

How can I detect compression or encryption algorithm used for packing exe file dynamically and statically ways ? (dynamic detect ways and static detect ways without signature base ways of course separately). I do not want any tools. I want ways for paper.

Improve this question

2 Answers 2

Reset to default
1

I've tried some heuristic methods of detecting specific compression/encryption streams based on data entropy; the bottom line is that they "kinda" worked, but in practice there was nothing conclusive. For example, it's easy to differentiate deflate compression streams from LZMA compression streams this way, but very hard to tell the difference between LZMA and AES.

The best way I've found for identifying raw compression streams is a brute-force approach (e.g., try decompressing it as deflate, then try LZMA, etc). It does work, but is slow, especially for LZMA streams where there are multiple compression options to test for each offset in the file/data.

Improve this answer
0

You can get a some part of compressed data, and compress it again. If ratio is high, these data was compressed/encrypted.

Improve this answer
3
  • Thank you. But I want detect kind of algorithm.for example the used algorithm is NRV2B or lzma1. of course with out search a string as a signature in file
    – Alireza Jafari Fard
    Commented May 16, 2015 at 8:04
  • It's impossible, in my opinion.
    – Artem_N
    Commented May 16, 2015 at 11:34
  • @AlirezaJafariFard instead of error-prone signature search, you could check the file's header and / or try to identify the algorithm by some of its properties (which is error-prone and spoof-able too, but that's surely better than a plain signature search)
    – rev
    Commented May 16, 2015 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.