|
Some packers / cryptors leave a signature in the file.. Either as a name of a section in the PE Header file or as bytes appended to the file.
Other packers / cryptors use standard bytes in their body or around their entry points or in certain places in the body of their unpack / decryption code.
I asked a question on the PEID forum a while ago about true polymorphic protectors (EG a protector that has no stable bytes at the entrypoint or anywhere in its body)
http://www.secretashell.com/PEiD/viewtopic.php?t=82
Basically to prevent detection of a packer or cryptor you need to understand what gives that packer away to the detectors. Is it stable bytes or a section header name or a certain DWORD in the PE header or any other thing.
The best way to discover this is to protect several different files with the same protector and try to find the similarities.
Results of your work will be apreciated !!
l8rz
|