Questions tagged [packers]

A chain of software made to build self-extractable archived software (with a focus on compression and/or on obfuscation). Packer prevent most of the static analysis techniques and force the reverser to *depack* dynamically the software before analyzing it.

Filter by
Sorted by
Tagged with
0
votes
2answers
89 views

How to protect a PE file?

What is the best way to protect a PE file (coded in c++) to make it a little hard for reversing, i mean using something like a Packer, but in a legit way, because most of packers are detected by ...
0
votes
0answers
243 views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
3
votes
1answer
247 views

Packers Material for learn how to unpack software

I would like to known where i can found guides to learn how to unpack packers like Themida, Armadillo, VMProtect, etc. I was searching challenges and guides but i could not found for packers, only ...
1
vote
0answers
43 views

Is this executable packed, encrypted or what?

I have an executable that I'd like to patch, but I'm very new to RE. I some have assembly knowledge of x86 as first learned language last year, but not of this one: PowerPC (in this case is PPC32), ...
0
votes
1answer
48 views

Packer changed memory in IDA?

I'm trying to analyze one binary protected by HASP. Since it is pretty old binary (2008) I managed to run it in IDA and it unpacked in memory. When I do tracing + take memory snapshot and reanalyze it,...
1
vote
3answers
452 views

Problems with relocation when unpacking

I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly. I started with compressing my simple x64....
0
votes
1answer
81 views

PE file export functions of packed file

I am new to reverse engineering and I am learning about packed files. I saw that most of the time I can recognize a packed file with a little number of import functions in PE file and not many strings ...
3
votes
1answer
3k views

VMProtect anti-debug method

I recently found a nice crackme which uses VMProtect 3.x as defense. After doing a little research online I found couple of API's VMProtect uses as an anti debug method. I set software breakpoint on ...
4
votes
2answers
4k views

How to disassemble a packed .NET executable?

I'm trying to reverse a Windows executable that shows as having been packed with ENIGMA(5.X): If I later check the class name for one of its UI elements, when the process is unpacked and running, it ...
1
vote
1answer
2k views

How detect version of VMProtect

I have a binary with VMProtect. Some tools giving info that this is 2.x, some that 3.x. How I could check it? Thanks.
1
vote
2answers
730 views

Recreating a lzma archive (non-streamed)

I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from ...
0
votes
1answer
703 views

Stone's PE Encrypter v2.0

Does anybody know an unpacker/decryptor that can unpack Stone's PE Encrypter v2.0? I found one but it was for a previous version, not version 2.0. IDA's universal unpacker seems to hang when trying to ...
2
votes
4answers
2k views

Unpacking xamarin mono dll from libmonodroid_bundle.app.so

I have an apk that was written in xamarin. The meta data suggests there are lots of dlls files this application uses. I found a file called libmonodroid_bundle_app.so which when disassembled in IDA ...
0
votes
1answer
132 views

Information about packers

i was trying to search for some information about packers just to learn more about it, there is a lot of stuff out there but its hard to find something that really explain that good and clear, I would ...
1
vote
1answer
2k views

Dose PE Explorer unpack upx executables?

I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe ...
0
votes
1answer
2k views

How to run and reconstruct a packed DLL in IDA Pro?

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
2
votes
1answer
530 views

What is Executable Compression? [closed]

I don't know whether this is the right place for this question or this question is too basic. I was reading Antivirus Hacker's Handbook, where they talked a bit about software packers, protectors, ...
2
votes
1answer
2k views

How to unpack kkrunchy executables?

I'm trying to figure out how to unpack kkruncy executable, sources here and binaries here, anyone knows how to do it? My main idea was testing out some little hello world exes compressed with ...
0
votes
1answer
2k views

Patch packed DLL by themida [closed]

How to patch dll file packed by themida? I've dumped the unpacked file and patched it. But the program didn't recognize the unpacked dll. The original file and dumped file have ~8mb different size. I ...
7
votes
1answer
4k views

Zte Reverse engineering config.bin file problem

I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider. My first discovery was that the eth Lan ports are bricked wich means I can only use ...
4
votes
2answers
2k views

Hooking functions in a VMProtect'ed executable

I'm trying to solve the Sharif CTF 2016 HI2.exe challenge. This challenge requires a specific (impossible to reach) environment (64 processors, 128GB RAM, ...) to display the flag. As the executable ...
1
vote
1answer
5k views

What it takes to write a simple PE file packer from scratch?

I was wondering to ask here what it takes to write a tiny simple packer for PE files? I know how a PE file looks like but not in accurate details (if necessary I'll learn as much as it takes) and I ...
5
votes
1answer
298 views

How can packers work despite mechanisms like Data Execution Prevention?

Modern operating systems have memory protections such as Data Execution Prevention, No Execute bit for Data, Read-only bit for text/code sections etc. I don't understand how packers work when these ...
2
votes
1answer
4k views

What's the packer/encrypter used with this file

I used PEiD & Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it. could someone help with this issue? EDIT: As @beatcracker said in comments, using ExeinfoPe ...
1
vote
1answer
163 views

How to deal with code that change its address among different execution

I think that this is a basic need of every reverser so this question may have been asked in other places but really, I'm unable to find an answer. Maybe I'm asking the wrong question. So, supposing I ...
3
votes
1answer
2k views

Unable to dump a process

I'm trying to reverse a malware sample with the following MD5: ef668a0cd0755c67930ece13d28a6bda. Obvious, this is a packed malware. On a first look, it seems to bee some GUI Programm, but at some ...
1
vote
1answer
310 views

Unpacking abo1.exe advanced buffer overflow challenge from www.binary-auditing.com

It seems abo1.exe advanced_buffer_overflow challenge is packed, I've tried to unpack it, but I am still beginner in unpacking.It seems it is packed manually. I've also tried OllyDump and ImortREC. ...
1
vote
2answers
830 views

identify packer compression or encryption algorithm

I do have an executable packed file. I want to detect compression or encryption algorithm dynamic and static ways separatly; of course without signature base way. How can I detect compression or ...
-1
votes
1answer
652 views

How can I statically unpack a file packed with an unknown packer without executing it?

I want to implement a generic, static unpacker that can statically unpack files that have been packed with unknown packers. In fact, I want it to be able to unpack packers which I just think of. ...
1
vote
3answers
4k views

Python: Adding a asection to a PE file

I am working with PE binaries using Python and the pefile library. Its good for reading information out of a binary and rewriting certain bytes. If I wanted to add a section to the file then i am ...
1
vote
0answers
116 views

Packers that partially decrypts contents on-the-fly

I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a ...
1
vote
0answers
258 views

How to remove SimplePack signature so it won't be detected by AVs

I've tried SimplePack, which is an open-source file packer for windows, now, for some reasons, when I check via online virus-checkers, lots of alerts are being popped saying the file is crypted using ...
1
vote
1answer
99 views

HOW do I point the debugger towards UNPACKED version of dll stored on my filesystem during debugging [closed]

Here is my problem: Program P1 launches another program P2. The P2 program uses a dll DLL1 which is packed using PE Compact. The DLL1 is obviously unpacked during run time and a routine inside DLL1 ...
2
votes
1answer
2k views

Does PeID signatures work with 64-Bit Portable Executable (EXE) files?

Can the signatures from PeID be used on 64-Bit Portable Executable (EXE) files? PeID does not support 64-Bit files but I can use the signatures in another application with 64-Bit support. My main ...
3
votes
3answers
4k views

Detecting packed 64-bit Windows Portable Executable (EXE) files

What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files). I am not interested in the packer used I would just like to know if the file is packed or ...
0
votes
4answers
224 views

What program can I use to detect protections used on a program and its libraries?

What are some good programs that can detect which protection software has been used on or in other programs and their libraries?
3
votes
1answer
554 views

How does IDA understand that the file was packed by packer?

So, how does IDA understand that the file was packed by a packer? How does it distinguishes between different types of packers? Are they leave some significant signatures or some patterns of ...
12
votes
5answers
28k views

Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?

Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
5
votes
2answers
13k views

Decoding the UPX ELF header file

Still on my way to understand how to prevent the usage of the -d (decompress) option of UPX (see this question), I try to identify the header file of UPX in ELF executable files. Looking at the code, ...
12
votes
2answers
28k views

How to prevent "upx -d" on an UPX packed executable?

I recently read a tweet from Ange about a technique to fool UPX when the option -d (decompress) is called. I would like to know how this is working and, what are the technique to prevent an UPX ...
5
votes
3answers
9k views

Packers/Protectors for Linux

I was wondering if anyone had come across a packer/protector which could be used for ELF binaries. There seem to be quite a few articles on writing packers and protectors for the PE format -- however, ...
3
votes
2answers
1k views

Is there a perfect method for protecting executable files?

I tried UPX, ASPack and other protectors, but it seems that my application has a weak protection. What is the best method for protecting your program? Using packers or something else? At least for a ...
3
votes
1answer
998 views

Known publicly available modified UPX ELF packer [closed]

Anyone know of any publicly available modified versions of UPX for ELF? I.e. one that is not able to be unpacked using upx -d. The unpacking stub in the binary is slightly obfuscated. I am looking to ...
5
votes
2answers
836 views

A PE packer: issues with the packed image base address

I am toying with writing a basic PE packer, whose job is simply to execute the attached target PE in memory. I have spent a couple of days getting intimate with the format, and I think that I have ...
17
votes
5answers
7k views

Is there any simple open source Windows packer?

There are great questions here about different types of packers and that is very interesting to me. I would like to try my hand at reverse engineering one. Since I am very new to this, I would like ...
13
votes
2answers
10k views

What are the different types of packers?

I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved. Yet, it seems that ...