0

What is the best way to protect a PE file (coded in c++) to make it a little hard for reversing, i mean using something like a Packer, but in a legit way, because most of packers are detected by antivirus (most of malwares are using packing techniques). Can we find a non blacklisted packers ?

Any ideas ?

1
  • Every packer freely available will be earlier or later used by malware authors. For commercial packers I would assume that malware authors use cracked versions. Therefore every packer you will be able to find will most likely also be used by malware authors.
    – Robert
    Aug 25 at 16:20
3

You really cannot. You can only slow a reverser down

The goal of the packer, crypter or anti debug methods, ect. is simply to slow the reverser . Eventually (if there is desire ) your code will be cracked

There are packers like ASProtect and others which will simply just encrypt or compress certian portions and create a loader for it to be unpacked at run time.

You can try various things like launch your program with with a debug hook already so that others cannot debug the program, but ultimately these are all trivial to bypass.

There is of course the best of the best Denuvo Enterprise encryption on your product. This of course costs money, but even this only slows down the reverser long enough to get sales from the product. This has been cracked and is constantly being cracked. Denuvo though updates its product regularly to combat these reversers, but again . You can only slow a reverser - not stop him.

You can make your own, but you will run the risk of malware detection. There are some commercial products which have a higher cost which should bypass antivirus. You should understand that the same techniques used to protect your PE are being used for malware.

You should ask what are you trying to protect from and what time frame and if it is just enough time to make sales then sometime standard should suffice. But if you are expecting something eternal to suffice to never be cracked or something, then it will never happen.

3
  • Excellent position, however you contradict yourself in the sense of being detected by malware, a protector or packer is usually detected as malware if it is eventually used by many people with suspicious actions and accesses, this risk drops by half for example if your final software is signed for a code signing certificate, preferably an EV certificate, as mentioned for the end consumer it is not as viable to develop a tool due to the high cost, and many use commercial alternatives being AS Protect just one of a great fine line of products.
    – 0x0A
    Aug 26 at 13:26
  • @LUser Thanks you for your helpful response, and what you said is true about everything, now i remember a tweet from PELock's author : twitter.com/PELock/status/881862661113303042 , '' they were no cracked copies " hummm he defies reversers or what lol ?
    – 9ys
    Aug 27 at 3:48
  • @0x0A yeah but he was talking about a comercial software ( its a little bit expensive to buy it and use it for malwares ) , then yes free packers and protectors can be used by many people doing malicious actions, like ConfuserEX used by the .net lovers.
    – 9ys
    Aug 27 at 3:53
1

Top-notch security for PE files is possible through something known as a virtualization engine - whereby your code is encrypted, never decrypted, and runs through a virtual CPU engine. This might slow down the performance of your code by quite a bit though - so it is often only used to protect key portions of the code.

Some packers that provide this feature are VMProtect, Themida. Might have a few more but I can't quite recall.

If you use an outdated packer (cracked versions are usually outdated), it would often have scripts available in public that helps someone to restore the original, unprotected PE file. So be prepared to pay a bomb to buy the official product, and keep it up to date.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.