I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a functions contents on the fly(when it is called) and jumps to it? Or of any packer/protector that does anything similar?

  • Armadillo (R.I.P.) did this, but it isn't open-source. – Jason Geffner Mar 5 '15 at 15:23
  • Maybe what you really want is 'virtualization'. it never even decrypts the code; it simply translates it to its own machine code and then interprets it. – rev Mar 5 '15 at 18:19
  • 1
    @AcidShout Thanks-- but no, I'm actually looking for a packer that does on-the-fly decoding of some sort. More than anything, I'm curious to play with a sample that uses such a packer. – user1743 Mar 5 '15 at 23:03
  • 1
    Shrinker might be easier in that respect - it installs an exception handler which intercepts the first access to individual pages, and they are decompressed only at that time. Not open source, but a very easy read. – peter ferrie Mar 7 '15 at 22:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy