Wednesday, February 15, 2012

A New Way to Detect Packers

Reverse engineering executables is always a very challenging procedure especially if the analyzed executable has been packed or encrypted.  I've been talking a lot about packers and unpackers (take a look to these posts here) but the technique I am going to show you is totally new respect to those already described.  As you might know the most difficult procedure of reversing a packed (or encrypted) executable is to find out the original entry point (OE). Again, there are tons of ways to figure out if an executable is packed or not (aka PEiD) but there is no a universal known way to unpack it. The following image shows PEiD in action.



PEID finds out that the executable has been packed with Aspack v2.12. Nowadays you might find specific unpackers (unpackers designed for a specific packing procedure)  but there is no way to have an ultimate universal unpacker. Here you can find many of those packers. YES, I know, there are universal unpackers too, but those unpackers are signature based, meaning that they are not able to unpack "new" packing procedure (algorithms), they must include the signature of every used algorithms. The following pictures shows one of my favorite Unpackers: Faster Universal Unpacker from RCE.



A group of the New Mexico Tech designed a visualization tool based on Entropy (system calls, oriented graphs and so on) called VERA (read more here, here and here).  By using this tool you are able to distinguish between packers / encryptors STUB and unpacked / decrypted code by simply analyzing the execution of the executable. The following image shows the notepad.exe (yes the one in WinXP) traced by PIN and visualized by VERA. I traced notepad.exe by fixing 2 minutes of execution here the result:


The blue label represents the Start address (which in this particular case corresponds to OE), yellow color means normal entropy, numbers in labels (you probably cannot see them because the image is too small) are the called addresses. The following image shows the same executable packet by using UPX. 


As you may see the are sections (calls to addresses) that have high entropy (meaning be packed or encrypted) represented with RED labels. This alerts us about the presence of a packer / encryptor. Where the is a continuously low entropy labels (purple) we can find the OE. This because the encryptor / packer STUB finished its job and unpacked / decrypted the executable code giving to the OE the control flow. The following image shows notepad.exe packed by BroExePacker.





In this case BroExePacker introduces a two levels of compression STUBs, you can easily distinguish them by looking at the red labels that are present in two points during the execution. This shows a typical two stage decompression. A first STUB decompress the function that decompress the real function who will decompress the original byte code (RED -PURPLE-RED-PURPLE). The OE is placed after the second RED labels. The following image shows the same executable (notepad.exe) compressed by the same BroExePacker but by using a different algorithm.


Again, we can easily discover that this executable has been packed, this time with one level STUB. The OE could be in a couple of positions. Experience will help a lot in finding the OE, but this Visualization tool considerably decrease the complexity of such operation. VERA could be integrated to IDA pro by installing an IDA Pro plugin making IDA Pro communicating to VERA through sockets. This integration makes a lot easier the interaction between the tracer (IDA Pro) and the visualization tool VERA. I  am not going to cover in this post how to integrate VERA with IDA, but I am rather cover how to use VERA and PIN in a very quick way. Once you download and  install VERA from its website ,  you will get the visualization tool (VERA) and a small installation of PIN.  PIN is the tracer, the one who will produce the  .trace file by executing the analyzed executable, the .trace file who will get VERA to elaborate  its diagram.  The following picture shows hot to run PIN with VERA template.


PIN is now running and tracing the analyzed executable. Let it running for a while (the time you decide) and then close the executable in a normal way (File -> Close, or whatever). Now opera VERA and click on Open. Select the file produced by PIN. Now VERA asks you about the original file and ask where to put its own graph file. The following image shows this process



Once you done with that, VERA will take a while and finally it will show you a graphic traced path. You will find more details on VERA and PIN manual. 

Summing up, I wanted to describe a new way to figure out if a executable has been packed or encrypted, and a new way to discover the Original Entry Point of the packed/encrypted executable. My experience in this field let me say that this is a great way to proceed and to learn about packers/encrypters.



90 comments:

crackinglandia said...

Nice approach!. If you are doing other things with Pin and unpacking maybe we can talk a little :)

Btw, thanks for mentioning FUU in your post! :P

Marco Ramilli said...

@crackinglandia
Of course we can talk a little ! I'll be happy

crackinglandia said...

I sent you an email.

Anonymous said...

Thanks for your posting about vera. I have a question vera's pin.exe. How to use pin.exe if packed dll file?

Thanks for read it.

surendar singh said...

I really feel good and the information is really good.

Sahara Packers | Sahara, Domestic International Packers and Movers in India for Packers India, International Movers, Domestic Packers, Movers India, Packing Services India, Unpacking Services, India Domestic Movers, Loading Unloading Services, International Couriers, Packers Delhi, Bangalore Packers, Movers Mumbai etc. are the helpful words that’s help our customer to easily make a best deal over the Internet with Sahara Packers & Movers. Sahara Packers is one of the best all Re-Allocation service provider in India.

Packers India | International Movers | Domestic Packers |

nikol robert said...

really its very nice information about packers and movers. thanks for shearing it with us. keep it up.
Best Moving Company NYC

niucool said...

Believe me, PackerBreaker is your ultimate choice of a universal unpacker.
http://www.sysreveal.com/packerbreaker-intro/

shainex said...

Nice Work , Packers and movers bangalore
welldone keep it up , look it this website:- http://www.shainex.com/karnataka/movers-packers-bangalore.htm

packers and movers bangalore said...

thank for this http://www.moversandpackersbangalore.com/

Ravi Geneticinfosoft said...

Iffco Home - Packers and Movers in Delhi

Alia Rechard said...

Thanks for Nice and Informative Post
This blog is really contains lot more information about relocation meant to online Moving Companies.

Packers and Movers in Thane said...

Best Packers and Movers Services....

Nice Share

Top Packers And Movers India said...

Packers and Movers Pune, Movers And Packers Pune
Century Packers and Movers is an Indiabased organization that offers professional packing services, professional moving services for your packing and moving requirements throughout India.

Packers Movers noida said...

Thanks to share a A New Way to Detect Packers it may very help full a find the movers and packers in current time.,..

Riddhi Siddhi said...

NICE BLOG!!! Packers and Movers are said to be those people who help you to pack and move your belongings in the safest and the most convenient way. Thanks for sharing a nice information.
packers and movers in jaipur
shifting services in jaipur

Layne Adams said...

If you are looking for fast friendly service then you have come to the right place. We provide many services to both residential and commercial clients. There is no job to big or small we can move it all.
movers medford, ma

Riddhi Siddhi said...

NICE BLOG!!! Packers and Movers are said to be those people who help you to pack and move your belongings in the safest and the most convenient way. Thanks for sharing a nice information.
packers and movers in jaipur
shifting services in jaipur

Movers and Packers in Chennai said...

This is a nice information about packers and movers .We are also provider packing and moving services .

Allen Smith said...

Really its very nice information about packers and movers. thanks for shearing it with us. keep it up.
Dallas Moving Company

Riddhi Siddhi said...

NICE BLOG!!! Packers and Movers are said to be those people who help you to pack and move your belongings in the safest and the most convenient way. Thanks for sharing a nice information.
packers and movers in jaipur
movers and packers in jaipur

Haroon khan said...

Nice blog and I fell very happy after read this content.
packers and movers pune :-packers and movers hyderabad:-packers and movers bangalore

India Packers said...

packers and movers
packers and movers lucknow
packers and movers ghaziabad
packers and movers noida
packers and movers delhi
packers and movers hyderabad
packers and movers chandigarh
packers and movers raipur
packers and movers kolkata
packers and movers kolkata
packers and movers gurgaon
packers and movers bangalore
packers and movers mumbai
packers and movers ranchi
packers and movers chennai
packers and movers pune
packers and movers faridabad
packers and movers jaipur
packers and movers ahmedabad

Bhaskar rudi pathan said...

packers movers bangalore
packers and movers bangalore
packers and movers delhi
packers and movers noida
packers and movers bhubaneswar
packers and movers gurgaon

yaseen khan said...

packers and movers bangalore
packers and movers chennai
packers and movers hyderabad
packers and movers delhi
packers and movers kolkata
packers and movers mumbai
packers and movers ahmedabad
packers and movers surat
packers and movers jaipur

Anonymous said...

Nice Approach to detect packers with Pin

We are an ISO Certified International Movers Dubai Contact WRAP IT Movers for all your local and International Moves in Dubai at affordable rates.

Ian said...

I’m too busy to do much online reading, but when my sister told me about your article, I read it. This is informative content with creative ideas and thoughtful commentary.
Packers and Movers in Delhi
Packers and Movers in gurgaon
Packers and Movers in Faridabad
Packers and Movers in Noida
Packers and Movers in Ghaziabad

John Ajax said...

Nice post.Thank you for taking the time to publish this information very useful! I’m still waiting for some interesting

thoughts from your side in your next post thanks

Man and Van Hire

Removalists Melbourne Cheap

Agarwal Packers said...

Very Useful information thanks for sharing...

Packers and movers
Packers and movers hyderabad
packers and movers bangalore
packers and movers chennai
packers and movers delhi
packers and movers gurgaon
packers and movers mumbai
packers and movers pune
packers and movers navi Mumbai
packers and movers bhubaneswar
packers and movers cochin
packers and movers lucknow
packers and movers noida

shriya ramachandaran said...

Hi
Icm is the one of the best organization in this field

Packers and Movers in Madhapur

Vinay said...

Southrncargo movers and packers Best moving company in Pune shivamcargo packers and movers
Professionla packers in pune Home shifting malad mumbai



manglammovers said...

NICE INFORMATION!!! It such a great difficulty shifting from one location to another because we never manage all the things and doesnt understand how to reach goods from one place to another in limited time but now with the help of packers and movers, shifting from one place to another becomes easier which provides the safest facilities with no losses like damage or broking of expensive goods etc. If any people looks for packers and movers in Jaipur, they can go through www.manglammovers.com. Thanks !!!

huma khan said...

Its an amazing way for shifting purpose.safe packers movers in is avail very good services..
Thank you..
http://www.shainex.com/

Packers and Movers Book said...

The material and aggregation is excellent and telltale as comfortably.

Packers and Movers in Bangalore
Packers and Movers in Delhi
Packers Movers Gurgaon
Movers and packers in Noida
household goods shifting

Surbhi AgarwalPackers said...

Thanks for sharing this post
Packers and Movers Services
Packers Movers India
Packers & Movers Services

Packers And Movers Bangalore To Mumbai said...

Real Cargo Packers & Movers Bangalore take immense pleasure in introducing ourselves as one of the leading, reliable packers and movers services and standing in the field of Packers & movers services with an experience of Packers & movers. Real Packers & Movers team is confident to handle any type of Packers & movers work and execute them in an efficient manner for ensuring complete customer satisfaction. Real Packers & Movers are one of the leading Lucknow based trustworthy, reliable and economical packers & movers services to pack and move safely.

Rajni sharma said...

Aryan International packers and movers is an Indian packing and moving service provider.

http://www.aryanpackersmovers.com

manglammovers said...

NICE POST!!! If any people want to move anywhere in lucknow with our costly goods and searching for Best Packers Movers, then your searches end here. Manglam Packers and Movers is most trusted Packers and Movers in Lucknow with quick response and very cheap price. CALL NOW +91-9415026922 Thanks!!!

priyanka rani said...

this is an impressive blog.i will continue read your article.Packers and Movers Delhi

Movers Packers Pune said...

Hey!! You well written information. Keep it up. you can also find more information about Packers & Movers in Pune, Please visit our online stores Movers and Packers in Pune.

Packers And Movers In Pune said...

Nice Information.

Venla Ketterer said...

Really it is a nice blog, I would like to tell you that you have given me much knowledge about it. Movers Reviews

ajit kumar said...
This comment has been removed by the author.
ajit kumar said...

Informative post.The best thing is that your blog really informative and critical.You can also get best transportation and moving service from gmpackersindia.in ,so try packaging and moving service from us.

hari said...

good packers and movers company which gives relocation services very gratefully.. Thanks regards
packers and movers madhapur

Liaise Packer and Movers said...

Its really useful post to all and thanks for sharing the information with us.
<a href="http://www.liaisepackersandmovers.com/>packersandmovers bhubaneswar</a>

Liaise Packer and Movers said...

Really its a nice information and thanks for sharing the information.
Packers and Movers Orissa

Santiago Move said...

Hi there, I was really inspired to find this internet site. The explanation becoming that this is these kinds of an useful post.
Truly wonderful blog hold it up.
cheap moving companies
dallas movers

Natalie Caisse said...

This has been a very significant blog indeed. I’ve acquired a lot of helpful information from your article. Thank you for sharing such relevant topic with us. I really love all the great stuff you provide. Thanks again and keep it coming. LocalMedWaste.Com

Mathilda Karlsson said...

The content was unbelievably amazing. A great movers tips are well written. Thanks a lot for posting it. Los Angeles Lice Removal

Kumar Saurabh said...

I’d be very thankful if you could elaborate a little bit further. Thank you!Great and awesome post.It is very helpful.This blog shows the importance of blog commenting. Thanks............
Packers and Movers Delhi,
Movers and Packers Delhi

Liaise Packer and Movers said...

We offer serices with a unique advantage and peace of mind.Now when you are shifting,cast aside such stress and worries.
Packers and Movers in Bhubaneswar

Movers Packers said...

Packers and Movers Gurgaon
Packers and Movers Bangalore
Packers and Movers Noida
Packers and Movers Delhi
Packers and Movers Faridabad
Packers and Movers Ghaziabad

decan said...

coachPackers and movers help in relocating our products safely and securely without any damage. For best packers and movers in bhubaneswar also visit
packers and movers in Bhubaneswar

puja shri said...

Great information,these service makes tension-free reloaction and provide mental peace.

Packers and Movers Delhi

Ruth said...

Most of the packers and movers have the necessary knowledge and skill in shifting techniques. Thus, the common benefits are - fewer chances of damage, quicker loading and unloading process, and better care and supervision throughout the process. That way, you receive your belongings and valuables intact, at the proper destination. As thorough professionals, they have better knowledge of tagging techniques than a layman. About Us

Pa Mo said...

thanks for sharing nice post & blog...

Packers and Movers in Delhi

top ad said...

Packers and movers gurgaon
Packers and movers ghaziabad
Packers and movers noida
Packers and movers delhi
Packers and movers pune
Packers and movers bangalore
Packers and movers ahmedabad
Packers and movers mumbai
Packers and movers hyderabad

Arvind Mishra said...

Hello..... Very nice! Find Most Affordable Packers and Movers for All India....
http://packersmoversdelhi.top8th.in/

ramashankar gupta said...

i like it .this is a best site .............http://top7th.in/packers-and-movers-in-hyderabad/

ramashankar gupta said...

blog of packers and movers .......................http://top7th.in/packers-and-movers-in-bangalore/

ramashankar gupta said...

any Guicies
this is the best oppourtinity of packers and movers and bangelore ......................http://packersandmoversbangalore.best4th.in/

Dalpat Singh said...

Thanks for sharing a helpful Post...Now, a days these type of services is very necessary. If any people transfer from one place to another within India, they can choose a best and trusted packers movers. Riddhi Siddhi Packers Movers is well reputed company in the field of packers movers since 15 years.

vijay prakash said...

oh my god all the guys using this blog for promting their Packers and movers company .but this is not Packers and Movers Gurgaon
or Movers and Packers Gurgaon Blog.

peterjohn said...

Pretty good post. I just came across your site and wanted to say that I’ve really enjoyed reading your posts. In any case I’ll be subscribing to your feed and I hope you will keep a good work!Cheer.
Best packers and movers hyderabad kondapur offers relocation services.
packersandmovershyderabadkondapur

saurabh kumar said...

Thanks for sharing for good post. Blogging is the best to increasing business.For more information :- Packers and Movers in Delhi, http://www.best4thmovers.in/packers-and-movers-delhi/

sohan ku said...

Packers and Movers in Mumbai - Best movers and packers Mumbai list with info of Website, Address, Contact Number, and place in Mumbai. Packers and Movers Mumbai is the best services provider in Mumbai within cheapest price.

vashan sahi said...

We are providing best moving services in all over India, We have better and better packers and movers companies that are done their work carefully and save your money. There is Cost-Free and Risk-Free services here.

Contact With us for Packers Movers
Packers and Movers Pune
Packers and Movers in Pune
Source: - http://packersmoverspune.3th.co.in

Movers and Packers Bangalore said...

It is very nice site for the blogger and it is provided nice information.Thanks you..


http://www.best4thmovers.in/packers-and-movers-bangalore/

vashan sahi said...

We are providing best moving services in all over India, We have better and better packers and movers companies that are done their work carefully and save your money. There is Cost-Free and Risk-Free services here.

Contact With us for India’s Top Moving Service
Packers and Movers in Pune
Packers and Movers Pune
Source: - http://packersmoverspune.3th.co.in

vijay prakash said...

packers and movers service give a Big relief from taking tension to shift . now hire packers and movers and be free of headache of shifting . Packers and Movers Bangalore
Packers and Movers In Bangalore

Movers and Packers Bangalore

Packers and Movers avenue-road

Packers and Movers infantry-road

Packers and Movers cubbon-road
http://localpackersmoversinbangalore.in/
http://best4thmovers.in/packers-and-movers-bangalore

vijay prakash said...

very good and according to need blog is written by author.
Packers and movers Gurgaon ,Packers and movers In Gurgaon

movers and Packers Gurgaon ,movers and packers In Gurgaon
Packers and Movers Gurgaon,Packers and Movers in Gurgaon

Movers and packers Gurgaon ,Movers and packers in Gurgaon

http://packersmoversgurgaon.best5th.in/

http://packersmoversgurgaon.top8th.in/

puja shri said...

Very nice article and useful service,packers and movers offers a relocation service with best effort.
Packers and Movers Delhi

Movers and Packers Delhi

vashan sahi said...

Lots of packers and movers just for this distinct Indian subcontinent local subcontinent produce safety programs corporations to provide somebody greatest risk-free procedures moving property.
Provide Best Services in :-
Packers and Movers in Pune
Packers and Movers Pune
Packers and Movers
Source: - http://packersandmoverspune.top3th.co.in

kshitijets said...

very useful blog .its content is very nice
packers and movers gurgaon

movers and packers gurgaon
Packers and Movers Mumbai
Packers and Movers in Mumbai

kshitijets said...

very nice blog .thanks for sharing
movers and packers in gurgaon

gurgaon packers and movers
Packers and Movers Mumbai
Packers and Movers Mumbai

Ram Niwas said...

Azad cargo experienced packers & movers in Surat has over the years formulated an ideal working model by incorporating some unique and user friendly initiatives to fulfill the demand of travelers to India for international delivery of Indian goods.

Dalpat Singh said...

Nice Information! Its very good choice to choose a packers and movers for shifting of your home or office. I am searching a blog for packers and movers in jaipur, but while my searching I found this blog and this blog is very useful for me . Thanks for blogging...

Anil Kumar said...

http://marcoramilli.blogspot.com/2012/02/new-way-to-detect-packers.html

Kapil Mishra said...

The business connected with Packers in addition to Shifting Providers within Delhi provide a wonderful knowledge to everyone it is customers.
Packers and Movers Delhi

puja shri said...

sound information about packers and movers, i really appreciate this article, thanks for sharing....

Packers and Movers Delhi

vishan sahu said...

Sound information about packers and Moves packers and movers bangalore
packers and movers bangalore

Rajesh Sharma said...

Interm movers in anand, hold great expertise in providing all sorts of packaging and moving services to our clients in India. Completely safe and secure shifting services are provided by using advanced technology equipment

kshitijets said...

Nice work .packers and movers Hyderabad
packers and movers in Hyderabad

movers and packers Gurgaon
movers and packers in Gurgaon

NEERAJA B said...

Thank you somuch for sharing this information
packers and movers in thane

Saraswathi a said...

Thanks to introduce with your service with us.This is really informative and I will for sure refer my friends the

same. see more at Packers

And Movers In Gurgaon

interm packers and movers in bharuch said...


• Despatch

Our client's products are gathered into applicable holding zones pending on their system for dissemination. All committals convey an one of a kind personality to support traceability and conveyance paperwork goes hand in hand with every outbound shipment. Where proper, finished shows might be sent to the client once the stacking procedure is finished and all accumulations from site are marked for.

Profits: Real time upgrades and full request traceability
Interm Packers and Movers in bharuch
Rajesh Sharma
9227331212
Email: info@intermpackersandmovers.in
Web: www.intermpackersandmovers.in

interm packers and movers in bharuch said...

General space is the procedure of holding stock in the warehouse, inasmuch as picking and pressing is a differentiate prepare that is launched once the items as of recently archived in the warehouse are required to fill an order/s that deliver the goods.
Interm Packers and Movers in bharuch
Rajesh Sharma
9227331212
Email: info@intermpackersandmovers.in
Web: www.intermpackersandmovers.in

bharat u said...

Packers And Movers Hyderabad

Pawan Kumar said...

thanks for sharing this wonderful info..
plz visit at:


Packers and Movers Mumbai

Packers and Movers in Mumbai


For more information
http://www.localpackersmoversinmumbai.in/

harsha n said...

Good packers and movers company which gives relocation services very gratefully.. Thanks regards packers and movers marathahalli