I want to analyze an executable that went through a packer to look for the parts that have been compressed or encrypted. Of course, it also means that I want to find the code for the decompression or decryption procedures in the executable. How can I find these ?

  • 2
    Generically for all executables packed with any packer? Or generically for all executables packed with a specific packer? Or specifically for a single executable packed with a specific packer? – Jason Geffner May 20 '15 at 19:33
  • Generally for all packer and all executable.If packer Specified, this work is easy – Alireza Jafari Fard May 21 '15 at 13:41

A good way to find compressed or encrypted parts in a binary is entropy investigation, as compressed and encrypted parts show a high degree of disorder (a value of 1 means maximum disorder). I can recommend the tool binwalk which produces a graphical output of the memory's entropy. The picture shows a binwalk output, as an example of such a static analysis of an embedded device, showing typical entropies of different memory parts. enter image description here

The bottom part is an overlay of the corresponding Ida memory map.


For most packers out there:

  • The start of the decompression or decryption is pretty much the entry point (with a bit of anti-debugging mixed in, perhaps).
  • The end of the decompression or decryption can't be found generically with static analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.