1

I want to analyze an executable that went through a packer to look for the parts that have been compressed or encrypted. Of course, it also means that I want to find the code for the decompression or decryption procedures in the executable. How can I find these ?

2
  • 2
    Generically for all executables packed with any packer? Or generically for all executables packed with a specific packer? Or specifically for a single executable packed with a specific packer? Commented May 20, 2015 at 19:33
  • Generally for all packer and all executable.If packer Specified, this work is easy Commented May 21, 2015 at 13:41

2 Answers 2

4

A good way to find compressed or encrypted parts in a binary is entropy investigation, as compressed and encrypted parts show a high degree of disorder (a value of 1 means maximum disorder). I can recommend the tool binwalk which produces a graphical output of the memory's entropy. The picture shows a binwalk output, as an example of such a static analysis of an embedded device, showing typical entropies of different memory parts. enter image description here

The bottom part is an overlay of the corresponding Ida memory map.

3

For most packers out there:

  • The start of the decompression or decryption is pretty much the entry point (with a bit of anti-debugging mixed in, perhaps).
  • The end of the decompression or decryption can't be found generically with static analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.