Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
What is the best way to protect a PE file (coded in c++) to make it a little hard for reversing, i mean using something like a Packer, but in a legit way, because most of packers are detected by antivirus (most of malwares are using packing techniques). Can we find a non blacklisted packers ?
Any ideas ?
You really cannot. You can only slow a reverser down
The goal of the packer, crypter or anti debug methods, ect. is simply to slow the reverser . Eventually (if there is desire ) your code will be cracked
There are packers like ASProtect and others which will simply just encrypt or compress certian portions and create a loader for it to be unpacked at run time.
You can try various things like launch your program with with a debug hook already so that others cannot debug the program, but ultimately these are all trivial to bypass.
There is of course the best of the best Denuvo Enterprise encryption on your product. This of course costs money, but even this only slows down the reverser long enough to get sales from the product. This has been cracked and is constantly being cracked. Denuvo though updates its product regularly to combat these reversers, but again . You can only slow a reverser - not stop him.
You can make your own, but you will run the risk of malware detection. There are some commercial products which have a higher cost which should bypass antivirus. You should understand that the same techniques used to protect your PE are being used for malware.
You should ask what are you trying to protect from and what time frame and if it is just enough time to make sales then sometime standard should suffice. But if you are expecting something eternal to suffice to never be cracked or something, then it will never happen.
Top-notch security for PE files is possible through something known as a virtualization engine - whereby your code is encrypted, never decrypted, and runs through a virtual CPU engine. This might slow down the performance of your code by quite a bit though - so it is often only used to protect key portions of the code.
Some packers that provide this feature are VMProtect, Themida. Might have a few more but I can't quite recall.
If you use an outdated packer (cracked versions are usually outdated), it would often have scripts available in public that helps someone to restore the original, unprotected PE file. So be prepared to pay a bomb to buy the official product, and keep it up to date.
