Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I want to know how detectors like Peid exe tools or protectid detect the packer/protection of pe files. I thought maybe some constant values when a program is packed, but i dont know well. Can someone explain me how that exactly works, the best way showing it in OllyDbg or other Debugers like that. Its a real mystery for me how those programs can detect that.
Thanks in advance for anything!
Most of these tools are signature based with some additional heuristics in place. Same goes for detecting compilers (by detecting compiler startup code and other signatures). It’s even easier to detect compiler then protectors since most protectors are morphing the part of code that does decryption/decompression of packed application.