3

What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files). I am not interested in the packer used I would just like to know if the file is packed or not.

I am aware of various PE file properties such as checking entropy, imports, etc. PeID is generally recommended but unfortunately does not support 64-bit files, is there a program that is similar and supports 64-bit files (I have a large number of files to be checked)? Any other advise to solve this problem?

I have come across a few programs but I am not sure if they are good.

2

protectionid supports x64 files no problem... and if you can think of anything i could add to it, just let me know and i'll see what i can do (new build is planned for halloween and it'll be a spooky 'theme').. just dont tell anyone, its a secret

  • what version was the first to support PE32+ ? – Ange Sep 11 '14 at 20:41
  • hmm, version 6, or possibly version 5, its supported pe32+ for quite some time – evlncrn8 Sep 12 '14 at 0:00
  • does protectionid use the features of the file (entropy, number of imports, etc) as well or is it only signature based? – Raphael Sep 12 '14 at 11:46
  • its a lot more than signature based, entropy, imphash, analysis of sections, characteristics and so on... its a bit more than just the simple ep signature scan other scanners do – evlncrn8 Sep 12 '14 at 13:06
1

I am only aware of two more packer detectors, Protection iD, and DiE(Detect it Easy) as Extreme Coders has mentioned.

However you are on to something. 64-bit reverse engineering is still in its infancy, apart from IDA, tools are just now being developed to work on 64-bit applications, as it is a new architecture(relative to the number of 64bit applications out there), and on Windows in particular, comes with its own set of quirks(Driver signing, PatchGuard) which significantly slows a reversing down. But even IDA have not yet released a 64-bit decompiler(though they claim it is almost ready) which is further confirmation of what I said.

  • 1
    IDA 6.6 already has a x64 decompiler – 0xec Sep 9 '14 at 17:23
  • Ah thanks for catching that, but this is IDA 6.6, x64 has been around for over a decade(though only recently did its use start to go up). My point still stands that 64-bit RE is still in its infancy. – farmdve Sep 9 '14 at 17:24
  • @farmvde - "My point still stands that 64-bit RE is still in its infancy". You've only asserted the point, not provided evidence to support it. While there may not be as many 64-bit RE tools, it does not mean it is in its infancy. There are many RE tools supporting 64-bit (radare2, Hopper, IDA Pro, x64_dbg, WinDbg, gdb, Visual DuxDebugger, Capstone, diStorm64, C4Decompiler, etc). – Mick Sep 9 '14 at 18:39
0

I use the following ones:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.