I want to analyze an executable that went through a packer to look for the parts that have been compressed or encrypted. Of course, it also means that I want to find the code for the decompression or decryption procedures in the executable. How can I find these ?
A good way to find compressed or encrypted parts in a binary is entropy investigation, as compressed and encrypted parts show a high degree of disorder (a value of 1 means maximum disorder). I can recommend the tool binwalk which produces a graphical output of the memory's entropy. The picture shows a binwalk output, as an example of such a static analysis of an embedded device, showing typical entropies of different memory parts.
The bottom part is an overlay of the corresponding Ida memory map.