Executable Packing
Packing and unpacking executable formats.
Contents
Literature
Documentation
Scientific Research
(December 2021)
(January 2016)
(May 2018)
:books: Literature
Datasets
Code for our DLS'21 paper - BODMAS: An Open Dataset for Learning based Temporal Analysis of PE Malware.
Sanitized version of the original dataset, PackingData, removing packed samples from the Notpacked folder but also samples in packer folders that failed to be packed (having a same hash as the original unpacked executable).
Collection of features from PE files that serve as a benchmark dataset for researchers.
Curated dataset of malware and benign Windows executable samples for malware researchers containing 1,044,394 Windows executable binaries and corresponding image representations with 864,669 labelled as malware and 179,725 as benign.
Malware samples, analysis exercises and other interesting resources.
Original dataset with sample PE files packed with a large variety of packers, including ASPack, BeRoEXEPacker, exe32pack, eXpressor, FSG, JDPack, MEW, Molebox, MPRESS, Neolite, NSPack, Pckman, PECompact, PEtite, RLPack, UPX, WinUpack, Yoda's Crypter and Yoda's Protector.
Datasets and codes that are needed to reproduce the experiments in the paper "When Malware is Packing Heat".
:package: Packers
Packers
Position-independent(reflective) PE loader that enables in-memory execution of native PE files(EXE, DLL, SYS).
Packer utility for compressing and complicating reversing compiled native code (native files), protecting resources, adding DRM, and packing into an optimized loader.
Low-level mutator (Headers/EP obfuscator) for native Windows PE files (x32/x64).
Protection tool using the second generation Android Hardening Protection, loading the encrypted DEX file from memory dynamically.
Compressing linker for Windows, specifically targeted towards executables with a size of just a few kilobytes.
Just a modern packer for elf binaries ( works on Linux executables only ).
A proof-of-concept packer for .NET executables, designed to provide a starting point to explain the basic principles of runtime packing.
Library for ELF obfuscation ; it uses PRESENT and blake244 to encrypt your payload on the fly.
Packer compressing .net assemblies, (ab)using the PE format for data storage.
Permissively-licensed packer for ELF executables using LZMA Zstandard or Deflate compression.
Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry.
A very simple windows EXE packing tool for learning or investigating PE structure.
Simple implementation of an ELF packer that creates stealthy droppers for loading malicious ELFs in-memory.
ELF packer - encrypt and inject self-decryption code into executable ELF binary target.
After 2010
Tools
Android application Identifier for packers, protectors, obfuscators and oddities - PEiD for Android.
Universal and automated unpacking system suitable for both Dalvik and ART.
Prototype analysis tool that estimates the likelihood that a binary file contains compressed or encrypted bytes.
Open-source tool to identify capabilities in PE, ELF or .NET executable files.
Tool to find code cave in PE image (x86 / x64) - Find empty space to place code in PE files.
DataSet File Format for exchanging datasets and converting to ARFF (for use with Weka), CSV or Packing-Box's dataset structure.
Library to Instrument Executable Formats ; Python package for parsing PE, ELF, Mach-O and DEX formats, modifying and rebuilding executables.
Robust parser for PE files with a flexible plugin architecture which allows users to statically analyze files in-depth.
Attack tool for altering packed samples so that they evade static packing detection.
A Python framework that uses machine learning algorithms to implement the metadata recovery attack against obfuscated programs.
Collection of OllyDbg scripts for unpacking many different packers.
Adaptive unpacking tool for tracking packing bahaviors and unpacking Android packed apps.
Fork of packerid.py using PEid signatures and featuring additional output types, formats, digital signature extraction, and disassembly support.
Packer identification multiplatform tool/library using the same database syntax as PEiD.
Docker image gathering many packing-related tools and for making datasets of packed executables for use with machine learning.
Freeware reversing tool for PE files aimed to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.
Multi-platform Python module to parse and work with Portable Executable files.
Tool for performing static analysis on PE malware and generic suspicious files.
Python implementation of PEiD featuring an additional tool for making new signatures.
Old-school reverse engineering tool (with a long history since 2002) for manipulating PE files.
Implemention attempt of the general approach for extracting the original hidden code of PE files without any heuristic assumptions.
Java library for static malware analysis of PE files with a focus on PE malformation robustness and anomaly detection.
Small Python script/library to detect whether an executable is packed.
A complete refactoring of the original project to a Python package with a console script to detect whether an executable is packed.
Packing detection tool based on the entropy value of the entry point section and the WRITE attribute.
Create adversarial attacks against machine learning Windows malware detectors.
Tool to help malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.
An index of Windows binaries, including download links for executables such as EXE, DLL and SYS files.
Generator for YARA rules - The main principle is the creation of yara rules from strings found in malware files while removing all strings that also appear in goodware files.
Automatic and platform-independent unpacker for Windows binaries based on emulation.
:wrench: Tools
Research
Papers
(April 2021)
(March 2016)