I am new to reverse engineering and I am learning about packed files. I saw that most of the time I can recognize a packed file with a little number of import functions in PE file and not many strings but can the export functions in PE file can give me hint if a file been packed?
-
You can pack just about any (possibly all) PE executables, but why would a packer need to add something to its exports? As soon as a packed executable is running, it should be no longer "aware" that it was ever compressed. (Without checking its own executable file, that is.) – Jongware Apr 30 '20 at 21:19
-
@usr2564301 in other words if a file has an export function I can assume that it is not compressed? – fusu May 1 '20 at 14:48
The presence or absence of exports alone is not enough to tell if a file is packed or unpacked. Most executables have no or very few exports but there are also legitimate executables with many exports. Packing can hide exports but might also leave them visible so it’s not a reliable indicator either way.
It’s better to use other means of detecting packed files: entropy, signatures, runtime analysis and so on.
answered May 4 '20 at 11:56
