I want to analyze an executable that went through a packer to look for the parts that have been compressed or encrypted. Of course, it also means that I want to find the code for the decompression or decryption procedures in the executable. How can I find these ?
-
2Generically for all executables packed with any packer? Or generically for all executables packed with a specific packer? Or specifically for a single executable packed with a specific packer?– Jason GeffnerMay 20, 2015 at 19:33
-
Generally for all packer and all executable.If packer Specified, this work is easy– Alireza Jafari FardMay 21, 2015 at 13:41
Add a comment
|
2 Answers
A good way to find compressed or encrypted parts in a binary is entropy investigation, as compressed and encrypted parts show a high degree of disorder (a value of 1 means maximum disorder). I can recommend the tool binwalk which produces a graphical output of the memory's entropy. The picture shows a binwalk output, as an example of such a static analysis of an embedded device, showing typical entropies of different memory parts.
The bottom part is an overlay of the corresponding Ida memory map.
For most packers out there:
- The start of the decompression or decryption is pretty much the entry point (with a bit of anti-debugging mixed in, perhaps).
- The end of the decompression or decryption can't be found generically with static analysis.
answered May 21, 2015 at 15:22
