So, how does IDA understand that the file was packed by a packer?

How does it distinguishes between different types of packers?

Are they leave some significant signatures or some patterns of byte code?

Or maybe they do modify the header of the file in some way?

1 Answer 1


IDA don't detect type of packer. Also, signatures are not used. Instead, it analyze PE-header: .idata section, entry point and import entries. This method is very accurate, has low false positives.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.