|
Well, like miaomiao said, most packers are identified by thier entrypoint signature. So changing the the sig of your entry point will defeat most packer ID tools. You could do this manually or code a tool to do it (i think there is a tool that does this already, but i dont recall the name). You could just put a few useless bytes at the beginning of the loader and increase the loader size a bit, you could manually recode some of the opcodes using different regs/opcodes, and prolly a few other things. You may also want to change the sections names to somthing else (another packer, all blank, your name). Anyway, i hope that helps and is the answer you were looking for.
Crudd [RET]
|