3

What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files). I am not interested in the packer used I would just like to know if the file is packed or not.

I am aware of various PE file properties such as checking entropy, imports, etc. PeID is generally recommended but unfortunately does not support 64-bit files, is there a program that is similar and supports 64-bit files (I have a large number of files to be checked)? Any other advise to solve this problem?

I have come across a few programs but I am not sure if they are good.

Improve this question
1

3 Answers 3

Reset to default
2

protectionid supports x64 files no problem... and if you can think of anything i could add to it, just let me know and i'll see what i can do (new build is planned for halloween and it'll be a spooky 'theme').. just dont tell anyone, its a secret

Improve this answer
4
  • what version was the first to support PE32+ ?
    – Ange
    Sep 11, 2014 at 20:41
  • hmm, version 6, or possibly version 5, its supported pe32+ for quite some time
    – evlncrn8
    Sep 12, 2014 at 0:00
  • does protectionid use the features of the file (entropy, number of imports, etc) as well or is it only signature based?
    – Raphael
    Sep 12, 2014 at 11:46
  • its a lot more than signature based, entropy, imphash, analysis of sections, characteristics and so on... its a bit more than just the simple ep signature scan other scanners do
    – evlncrn8
    Sep 12, 2014 at 13:06
1

I am only aware of two more packer detectors, Protection iD, and DiE(Detect it Easy) as Extreme Coders has mentioned.

However you are on to something. 64-bit reverse engineering is still in its infancy, apart from IDA, tools are just now being developed to work on 64-bit applications, as it is a new architecture(relative to the number of 64bit applications out there), and on Windows in particular, comes with its own set of quirks(Driver signing, PatchGuard) which significantly slows a reversing down. But even IDA have not yet released a 64-bit decompiler(though they claim it is almost ready) which is further confirmation of what I said.

Improve this answer
3
  • 1
    IDA 6.6 already has a x64 decompiler
    – 0xec
    Sep 9, 2014 at 17:23
  • Ah thanks for catching that, but this is IDA 6.6, x64 has been around for over a decade(though only recently did its use start to go up). My point still stands that 64-bit RE is still in its infancy.
    – farmdve
    Sep 9, 2014 at 17:24
  • @farmvde - "My point still stands that 64-bit RE is still in its infancy". You've only asserted the point, not provided evidence to support it. While there may not be as many 64-bit RE tools, it does not mean it is in its infancy. There are many RE tools supporting 64-bit (radare2, Hopper, IDA Pro, x64_dbg, WinDbg, gdb, Visual DuxDebugger, Capstone, diStorm64, C4Decompiler, etc).
    – Mick
    Sep 9, 2014 at 18:39
0

I use the following ones:

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.