18

There are great questions here about different types of packers and that is very interesting to me. I would like to try my hand at reverse engineering one. Since I am very new to this, I would like the source code as well.

I am hoping that by continuously compiling and recompiling the source, I can learn to match it up in IDA Pro and gain a better understanding of both topics at once.

I've checked out the source code for UPX but it is very complex as it handles many different platforms and types.

Is there an open source code packer that deals exclusively with Windows executables and is very simple to understand?

Improve this question
2
  • A packer isn't the best method to learn to correlate pseudo-C with the disassembly in front of you. You should instead focus on learning these skills separately. Once learned, it becomes a matter of training (experience) more than anything, so once you "mastered" the skills separately to an extent where you can use them, you can still go and combine them and will still learn a whole lot of new things.
    – 0xC0000022L ♦
    Commented Apr 16, 2013 at 15:23
  • 2
    @0xC0000022L Sure, I was hoping that that motivation to understand packers would help keep me focused. Short-sighted and instant gratification-minded youth and all that. I appreciate the suggestion, though.
    – mikhailzhan
    Commented Apr 16, 2013 at 16:09

5 Answers 5

Reset to default
12

  • SimplePack is simple and open-source (albeit in ASM, not in C)

    SimplePack is not trivial, yet simple enough so that I typically use it myself as a first 'hands-on' for binary packer training.

  • also, my minimalists packers (source/binaries) in python (EP-patcher, compresser, cryptor, dropper, protecter, virtualizer, mutater). No real use, but made as smallest possible examples for studies.

  • For reference only, PolyEnE is also open-source (in ASM, again), but not very simple - YMMV.
Improve this answer
5
  • 2
    Your minimalists packers in Python are fantastic. Just reading the code for that makes the rest of this make more sense. I'm curious though, I'm trying to use compressor.py on a calc.exe from Windows XP and aplib is failing to do the compression (assert >= 2 in line 91 of _bits). Is this possibly a known bug? Or (very likely) I'm just doing something wrong?
    – mikhailzhan
    Commented Apr 16, 2013 at 17:04
  • Thanks - it's no surprise they work badly though, they just had to work on my helloworld.exe program (the virt&mutaters only handle push/call) - they're PoCs skeletons to give an idea, for training, nothing more.
    – Ange
    Commented Apr 16, 2013 at 17:11
  • 1
    @mikhailzhan I got a little further exchanging the lzss algorithm for a different one (quibble.googlecode.com/hg/dgreed/tools/lzss.py). But now the application fails to start (side-by-side error. Depends.exe blows up at the lack of imports table). Still, great work to build from. Ange deserves much praise for writing very readable code.
    – mrduclaw
    Commented Apr 16, 2013 at 17:31
  • @Ange Thank you for your response! I'll try compiling just a hello world to play with, then. Thank you very much!
    – mikhailzhan
    Commented Apr 16, 2013 at 17:33
  • I just added a link to binaries
    – Ange
    Commented Apr 16, 2013 at 19:33
9

This looks like what you want: sePACK

A simple windows .exe/.dll packer. (Compresses code section and your compiled binaries waste less space) Almost whole codes written in pure C and very minimal also understandable (which makes modifying very easy; like debugger traps, encryption etc.)

Improve this answer
2
  • I installed CodeBlocks (the suggested IDE in the ReadMe) and it fails to build sePack. Looks like a newer version of gcc broke it. :/
    – mikhailzhan
    Commented Apr 15, 2013 at 23:06
  • I suppose you could ask how to fix it on stackoverflow and if it is something pertaining to reversing here! Specific errors help of course... I would build it myself but haven't the time this week.
    – cb88
    Commented Apr 16, 2013 at 10:13
6

I recommend you to take a look to Yoda's Protector. There is a version with source code. Unfortunately, it doesn't work on Windows 7 for some reason (but does work on Win XP). Apart from this, I don't know any other open source packer or protector (except UPX, as you mentioned).

Improve this answer
2
  • Yoda's looks a bit more complex for a beginner as it also includes encryption and optimisation as well as anti debugging. I guess it depends on if he wants to focus on one thing packing or bite off a bigger chunk and learn it all in one place.
    – cb88
    Commented Apr 15, 2013 at 22:49
  • @cb88 Yes, just the simplest please.
    – mikhailzhan
    Commented Apr 15, 2013 at 23:00
5

Here are 4 open-source packers, written in Delphi (you can convert to C++ if you want):

  1. ExeFog 1.1
  2. Polymorphic Crypter, Morphine
  3. AHPacker 0.1
  4. GHF Protector 1.0

If you don't have a copy of Delphi, you can use the open-source Lazarus IDE with the Free Pascal (FPC) compiler.

Lazarus + FPC can open Delphi project files and can usually compile Delphi projects without modification: http://sourceforge.net/projects/lazarus/

Improve this answer
5

You might be better off looking at a generic data packer first, such as LZ4. It's a very simple packer written in C. There are various unpackers in several languages, too, on the same site. Jumping right into a runtime packer means lots of file format details that, really, no-one gets quite right in all cases.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.