I do have an executable packed file.

I want to detect compression or encryption algorithm dynamic and static ways separatly; of course without signature base way.

How can I detect compression or encryption algorithm used for packing exe file dynamically and statically ways ? (dynamic detect ways and static detect ways without signature base ways of course separately). I do not want any tools. I want ways for paper.


I've tried some heuristic methods of detecting specific compression/encryption streams based on data entropy; the bottom line is that they "kinda" worked, but in practice there was nothing conclusive. For example, it's easy to differentiate deflate compression streams from LZMA compression streams this way, but very hard to tell the difference between LZMA and AES.

The best way I've found for identifying raw compression streams is a brute-force approach (e.g., try decompressing it as deflate, then try LZMA, etc). It does work, but is slow, especially for LZMA streams where there are multiple compression options to test for each offset in the file/data.


You can get a some part of compressed data, and compress it again. If ratio is high, these data was compressed/encrypted.

  • Thank you. But I want detect kind of algorithm.for example the used algorithm is NRV2B or lzma1. of course with out search a string as a signature in file – Alireza Jafari Fard May 16 '15 at 8:04
  • It's impossible, in my opinion. – Artem_N May 16 '15 at 11:34
  • @AlirezaJafariFard instead of error-prone signature search, you could check the file's header and / or try to identify the algorithm by some of its properties (which is error-prone and spoof-able too, but that's surely better than a plain signature search) – rev May 16 '15 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.