📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Identifying Encryption/Compression

Topic created on: January 18, 2007 19:46 CST by MIPs .

Let me start by saying Hello to everyone. Post #1 ^^

I was wondering if there were any generic ways to spot if a file has been encrypted/compressed besides the obvious way of not seeing any readable strings outside of the header.

  Nevar     January 18, 2007 22:33.14 CST
For packed files the physical sizes of sections will be much smaller than the virtual sizes.

Lack of obvious strings is a good example of encrypted data.

Also, if u look at the entrypoint bytes and see a distinct lack of typical prologue chances are the file is packed and/or encrypted.

Also, a lack of imported APIs can be a reasonable indicator that the file is possibly packed.

-nevar

  sp     January 19, 2007 04:57.31 CST
You can calculate the entropy ( http://en.wikipedia.org/wiki/Information_entropy ) of a file. PeID for example uses entropy values of files as a heuristic to determine whether a file is packed or not. Packed files have high entropies, files that are not packed have low entropies.

Using entropy to distinguish between packed and unpacked executables is not an exact science though. Without testing it I assume that files like self-extracting archives or setup files have a high entropy not because they're packed with an EXE packer but because they contain lots of compressed data.

  Sirmabus     January 20, 2007 19:14.49 CST
Has unusual, paternable (use a DB of packer section names), and, or, missing section names.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit