Packing and unpacking: code that reveals itself at runtime

March 21, 2025 · 1 min read · #reverse-engineering #malware #packing

Packing wraps the real code in a stub that decompresses/decrypts it at runtime. On disk there is nothing to analyze: high entropy, minimal IAT, few strings.

Unpacking

The goal is finding the Original Entry Point: the moment the stub has rebuilt the code and is about to jump into it. You breakpoint on write+execute of the revealed region, or on typical APIs (VirtualAlloc, LoadLibrary), then dump memory and rebuild the IAT.

# in a debugger: run to OEP, then dump + fix IAT (Scylla)
# UPX (benign packer): upx -d file.exe

Defence/analysis

Sandboxes and emulation auto-unpack by running the sample. Entropy and writable+executable sections are static indicators. Packers are not malicious per se (software protection), but they are the norm in malware.

« back to home