Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
So, how does IDA understand that the file was packed by a packer?
How does it distinguishes between different types of packers?
Are they leave some significant signatures or some patterns of byte code?
Or maybe they do modify the header of the file in some way?
IDA don't detect type of packer. Also, signatures are not used. Instead, it analyze PE-header: .idata section, entry point and import entries. This method is very accurate, has low false positives.
