Questions tagged [packers]
A chain of software made to build self-extractable archived software (with a focus on compression and/or on obfuscation). Packer prevent most of the static analysis techniques and force the reverser to *depack* dynamically the software before analyzing it.
50
questions
5
votes
1
answer
345
views
How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?
I have a .NET executable that is started using the process-hollowing technique. Here's how it looks from the Detect-It-Easy tool:
I can open the image file for that process (from disk) with dnSpyEx, ...
- 1,517
3
votes
1
answer
819
views
How do I reverse an exe packed with an unknown packer?
I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used...
How can I unpack it if it's possible? ...
- 33
1
vote
0
answers
151
views
silvio packer for shared libray leads to error: "ELF load command address/offset not properly aligned"
I'm trying to implement a packer based on silvio infection. The packer works fine for ET_EXEC. However, it failed with "ELF load command address/offset not properly aligned" error for the ...
- 81
1
vote
0
answers
69
views
failed to trigger packer's loader by overwritting the entry of rela.dyn on aarch64
I have implemented packer of x86_64 shared library.
Briefly, a loader is injected to a shared library, and
the rela.dyn entry is modified such that it points to the address of the loader. Once the ...
- 81
0
votes
2
answers
311
views
How to protect a PE file?
What is the best way to protect a PE file (coded in c++) to make it a little hard for reversing, i mean using something like a Packer, but in a legit way, because most of packers are detected by ...
- 19
0
votes
0
answers
2k
views
How to disassemble an obfuscated .NET DLL?
I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL:
Any idea how to unpack it?
- 1,517
3
votes
1
answer
414
views
Packers Material for learn how to unpack software
I would like to known where i can found guides to learn how to unpack packers like Themida, Armadillo, VMProtect, etc. I was searching challenges and guides but i could not found for packers, only ...
- 33
1
vote
0
answers
56
views
Is this executable packed, encrypted or what?
I have an executable that I'd like to patch, but I'm very new to RE. I some have assembly knowledge of x86 as first learned language last year, but not of this one: PowerPC (in this case is PPC32), ...
- 188
0
votes
1
answer
64
views
Packer changed memory in IDA?
I'm trying to analyze one binary protected by HASP. Since it is pretty old binary (2008) I managed to run it in IDA and it unpacked in memory. When I do tracing + take memory snapshot and reanalyze it,...
- 101
1
vote
3
answers
889
views
Problems with relocation when unpacking
I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly.
I started with compressing my simple x64....
- 11
0
votes
1
answer
177
views
PE file export functions of packed file
I am new to reverse engineering and I am learning about packed files.
I saw that most of the time I can recognize a packed file with a little number of import functions in PE file and not many strings ...
- 123
3
votes
1
answer
4k
views
VMProtect anti-debug method
I recently found a nice crackme which uses VMProtect 3.x as defense.
After doing a little research online I found couple of API's VMProtect uses as an anti debug method.
I set software breakpoint on ...
- 31
4
votes
2
answers
7k
views
How to disassemble a packed .NET executable?
I'm trying to reverse a Windows executable that shows as having been packed with ENIGMA(5.X):
If I later check the class name for one of its UI elements, when the process is unpacked and running, it ...
- 1,517
1
vote
1
answer
3k
views
How detect version of VMProtect
I have a binary with VMProtect. Some tools giving info that this is 2.x, some that 3.x. How I could check it? Thanks.
- 21
1
vote
2
answers
1k
views
Recreating a lzma archive (non-streamed)
I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from ...
- 11
0
votes
1
answer
835
views
Stone's PE Encrypter v2.0
Does anybody know an unpacker/decryptor that can unpack Stone's PE Encrypter v2.0? I found one but it was for a previous version, not version 2.0. IDA's universal unpacker seems to hang when trying to ...
- 207
2
votes
4
answers
3k
views
Unpacking xamarin mono dll from libmonodroid_bundle.app.so
I have an apk that was written in xamarin. The meta data suggests there are lots of dlls files this application uses. I found a file called libmonodroid_bundle_app.so which when disassembled in IDA ...
- 253
0
votes
1
answer
144
views
Information about packers
i was trying to search for some information about packers just to learn more about it, there is a lot of stuff out there but its hard to find something that really explain that good and clear,
I would ...
- 45
1
vote
1
answer
2k
views
Dose PE Explorer unpack upx executables?
I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe ...
- 125
0
votes
1
answer
3k
views
How to run and reconstruct a packed DLL in IDA Pro?
I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
- 103
2
votes
1
answer
616
views
What is Executable Compression? [closed]
I don't know whether this is the right place for this question or this question is too basic.
I was reading Antivirus Hacker's Handbook, where they talked a bit about software packers, protectors, ...
- 133
2
votes
1
answer
2k
views
How to unpack kkrunchy executables?
I'm trying to figure out how to unpack kkruncy executable, sources here and binaries here, anyone knows how to do it?
My main idea was testing out some little hello world exes compressed with ...
- 89
0
votes
1
answer
2k
views
Patch packed DLL by themida [closed]
How to patch dll file packed by themida? I've dumped the unpacked file and patched it. But the program didn't recognize the unpacked dll. The original file and dumped file have ~8mb different size.
I ...
- 3
8
votes
1
answer
5k
views
Zte Reverse engineering config.bin file problem
I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider.
My first discovery was that the eth Lan ports are bricked wich
means I can only use ...
4
votes
2
answers
2k
views
Hooking functions in a VMProtect'ed executable
I'm trying to solve the Sharif CTF 2016 HI2.exe challenge. This challenge requires a specific (impossible to reach) environment (64 processors, 128GB RAM, ...) to display the flag. As the executable ...
- 109
1
vote
1
answer
6k
views
What it takes to write a simple PE file packer from scratch?
I was wondering to ask here what it takes to write a tiny simple packer for PE files?
I know how a PE file looks like but not in accurate details (if necessary I'll learn as much as it takes) and I ...
- 131
5
votes
1
answer
323
views
How can packers work despite mechanisms like Data Execution Prevention?
Modern operating systems have memory protections such as Data Execution Prevention, No Execute bit for Data, Read-only bit for text/code sections etc.
I don't understand how packers work when these ...
- 153
2
votes
1
answer
4k
views
What's the packer/encrypter used with this file
I used PEiD & Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it.
could someone help with this issue?
EDIT:
As @beatcracker said in comments, using ExeinfoPe ...
- 187
1
vote
1
answer
200
views
How to deal with code that change its address among different execution
I think that this is a basic need of every reverser so this question may have been asked in other places but really, I'm unable to find an answer. Maybe I'm asking the wrong question.
So, supposing I ...
3
votes
1
answer
2k
views
Unable to dump a process
I'm trying to reverse a malware sample with the following MD5: ef668a0cd0755c67930ece13d28a6bda.
Obvious, this is a packed malware. On a first look, it seems to bee some GUI Programm, but at some ...
- 426
1
vote
1
answer
330
views
Unpacking abo1.exe advanced buffer overflow challenge from www.binary-auditing.com
It seems abo1.exe advanced_buffer_overflow challenge is packed, I've tried to unpack it, but I am still beginner in unpacking.It seems it is packed manually. I've also tried OllyDump and ImortREC.
...
- 139
1
vote
2
answers
937
views
identify packer compression or encryption algorithm
I do have an executable packed file.
I want to detect compression or encryption algorithm dynamic and static ways separatly; of course without signature base way.
How can I detect compression or ...
-1
votes
1
answer
710
views
How can I statically unpack a file packed with an unknown packer without executing it?
I want to implement a generic, static unpacker that can statically unpack files that have been packed with unknown packers.
In fact, I want it to be able to unpack packers which I just think of.
...
1
vote
3
answers
4k
views
Python: Adding a asection to a PE file
I am working with PE binaries using Python and the pefile library. Its good for reading information out of a binary and rewriting certain bytes. If I wanted to add a section to the file then i am ...
- 21
1
vote
0
answers
125
views
Packers that partially decrypts contents on-the-fly
I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a ...
user1743
1
vote
0
answers
268
views
How to remove SimplePack signature so it won't be detected by AVs
I've tried SimplePack, which is an open-source file packer for windows,
now, for some reasons, when I check via online virus-checkers, lots of alerts are being popped saying the file is crypted using ...
- 133
1
vote
1
answer
119
views
HOW do I point the debugger towards UNPACKED version of dll stored on my filesystem during debugging [closed]
Here is my problem:
Program P1 launches another program P2.
The P2 program uses a dll DLL1 which is packed using PE Compact.
The DLL1 is obviously unpacked during run time and a routine inside DLL1 ...
- 203
2
votes
1
answer
3k
views
Does PeID signatures work with 64-Bit Portable Executable (EXE) files?
Can the signatures from PeID be used on 64-Bit Portable Executable (EXE) files?
PeID does not support 64-Bit files but I can use the signatures in another application with 64-Bit support.
My main ...
- 51
3
votes
3
answers
4k
views
Detecting packed 64-bit Windows Portable Executable (EXE) files
What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files).
I am not interested in the packer used I would just like to know if the file is packed or ...
- 51
0
votes
4
answers
234
views
What program can I use to detect protections used on a program and its libraries?
What are some good programs that can detect which protection software has been used on or in other programs and their libraries?
3
votes
1
answer
676
views
How does IDA understand that the file was packed by packer?
So, how does IDA understand that the file was packed by a packer?
How does it distinguishes between different types of packers?
Are they leave some significant signatures or some patterns of ...
- 433
12
votes
5
answers
29k
views
Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?
Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
- 223
5
votes
2
answers
15k
views
Decoding the UPX ELF header file
Still on my way to understand how to prevent the usage of the -d (decompress) option of UPX (see this question), I try to identify the header file of UPX in ELF executable files.
Looking at the code, ...
- 18.9k
13
votes
2
answers
33k
views
How to prevent "upx -d" on an UPX packed executable?
I recently read a tweet from Ange about a technique to fool UPX when the option -d (decompress) is called.
I would like to know how this is working and, what are the technique to prevent an UPX ...
- 18.9k
6
votes
3
answers
11k
views
Packers/Protectors for Linux
I was wondering if anyone had come across a packer/protector which could be used for ELF binaries. There seem to be quite a few articles on writing packers and protectors for the PE format -- however, ...
user1743
4
votes
2
answers
1k
views
Is there a perfect method for protecting executable files?
I tried UPX, ASPack and other protectors, but it seems that my application has a weak protection.
What is the best method for protecting your program? Using packers or something else?
At least for a ...
- 187
3
votes
1
answer
1k
views
Known publicly available modified UPX ELF packer [closed]
Anyone know of any publicly available modified versions of UPX for ELF? I.e. one that is not able to be unpacked using upx -d. The unpacking stub in the binary is slightly obfuscated. I am looking to ...
- 131
6
votes
2
answers
907
views
A PE packer: issues with the packed image base address
I am toying with writing a basic PE packer, whose job is simply to execute the attached target PE in memory. I have spent a couple of days getting intimate with the format, and I think that I have ...
- 63
18
votes
5
answers
8k
views
Is there any simple open source Windows packer?
There are great questions here about different types of packers and that is very interesting to me. I would like to try my hand at reverse engineering one. Since I am very new to this, I would like ...
- 183
15
votes
2
answers
12k
views
What are the different types of packers?
I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved.
Yet, it seems that ...
- 18.9k