# Packer and Protector Identification Guide

## Overview

Packers compress or encrypt executable code to reduce file size or hinder analysis.
Protectors add additional anti-analysis features like anti-debugging, VM detection,
and code virtualization. Identifying the packer is the first step in unpacking.

## Identification Methods

### 1. Entropy Analysis

Entropy measures randomness in data (0 = uniform, 8 = maximum randomness).

| Entropy Range | Interpretation |
|--------------|----------------|
| 0.0 - 1.0 | Empty/zeroed section |
| 1.0 - 5.0 | Normal code or data |
| 5.0 - 6.5 | Typical compiled code |
| 6.5 - 7.0 | Possibly compressed or obfuscated |
| 7.0 - 7.5 | Likely compressed (zlib, LZMA) |
| 7.5 - 8.0 | Likely encrypted (AES, RC4) |

**Section-level entropy patterns:**

- **UPX**: One section with entropy ~0.0 (UPX0), one with entropy ~7.9 (UPX1)
- **Themida**: All sections with entropy > 7.5, non-standard names
- **VMProtect**: .vmp sections with entropy > 7.0
- **ASPack**: .adata section with high entropy

### 2. Section Name Patterns

| Packer | Section Names |
|--------|--------------|
| UPX | UPX0, UPX1, UPX2 |
| ASPack | .aspack, .adata |
| Themida | .themida, .winlice, or 8 spaces |
| VMProtect | .vmp0, .vmp1, .vmp2 |
| PECompact | pec1, pec2, PEC2 |
| MPRESS | .MPRESS1, .MPRESS2 |
| Enigma | .enigma1, .enigma2 |
| NSPack | .nsp0, .nsp1, .nsp2 |
| PEtite | .petite |
| Obsidium | .obsidiu |

### 3. Signature Bytes at Entry Point

| Packer | EP Bytes (hex) |
|--------|---------------|
| UPX | `60 BE xx xx xx xx` (pushad; mov esi, ...) |
| ASPack | `60 E8 03 00 00 00 E9 EB` |
| PECompact | `B8 xx xx xx xx 50 64 FF 35` |
| FSG 1.x | `BE xx xx xx xx AD 93 AD` |
| FSG 2.0 | `BB D0 01 40 00 BF 00 10` |
| MEW | `E9 xx xx xx xx 00 00 00 00` |
| PEtite | `B8 xx xx xx xx 68 xx xx xx xx 64 FF 35` |

### 4. PE Header Anomalies

Indicators of packing in PE headers:

- **Minimal imports**: Less than 5 imported DLLs, often just `kernel32.dll` with
  `LoadLibrary`, `GetProcAddress`, `VirtualAlloc`, `VirtualProtect`
- **Large raw size discrepancy**: Virtual size much larger than raw size (unpacking target)
- **Zero raw size sections**: Sections with raw_size=0 but large virtual_size
- **W+X sections**: Sections with both Write and Execute permissions
- **Unusual entry point**: EP outside .text section or in a non-standard section
- **Missing/small .text section**: Code section is tiny or absent
- **Large overlay data**: Significant data after the last PE section

### 5. Behavioral Indicators

Runtime behaviors that suggest packing:

- **Self-modifying code**: Writes to its own code sections
- **VirtualAlloc + VirtualProtect**: Allocates RWX memory for unpacking
- **Heavy API resolution**: Calls LoadLibrary/GetProcAddress many times at startup
- **Memory section creation**: Creates new sections and copies code
- **Process hollowing**: Creates suspended process and replaces its memory
- **Tail jump**: After unpacking stub, a far JMP to the original entry point

## Packer Profiles

### UPX (Ultimate Packer for eXecutables)

- **Type**: Open-source compressor
- **Difficulty**: Easy (automated unpacking)
- **Sections**: UPX0 (empty), UPX1 (compressed data), UPX2 (import info)
- **Unpacking**: `upx -d file.exe`
- **Notes**: Most common packer. Malware authors often modify the header to
  prevent standard `upx -d`. Fix by restoring the UPX! magic bytes.

### Themida / WinLicense

- **Type**: Commercial protector
- **Difficulty**: Very hard
- **Features**: Code virtualization, anti-debug, anti-VM, anti-dump
- **Sections**: Custom names or spaces, very high entropy
- **Unpacking**: Manual only (debugger + dump + IAT fix), Oreans UnVirtualizer plugin
- **Notes**: Uses a custom virtual machine to execute protected code

### VMProtect

- **Type**: Commercial protector
- **Difficulty**: Very hard
- **Features**: Code virtualization, mutation, anti-debug
- **Sections**: .vmp0, .vmp1, .vmp2
- **Unpacking**: Extremely difficult due to VM-based protection
- **Notes**: Each protected function is compiled to custom bytecode

### ASPack

- **Type**: Compressor
- **Difficulty**: Medium
- **Sections**: .aspack, .adata
- **Unpacking**: Manual OEP finding + dump, or AspackDie tool
- **Notes**: Sets breakpoint on pushad/popad pattern to find OEP

### PECompact

- **Type**: Compressor
- **Difficulty**: Easy-Medium
- **Sections**: pec1, pec2
- **Unpacking**: Dedicated unpackers available, or manual
- **Notes**: Uses API forwarding that needs IAT reconstruction

### Enigma Protector

- **Type**: Commercial protector
- **Difficulty**: Hard
- **Features**: Registration system, anti-debug, anti-VM, file virtualization
- **Sections**: .enigma1, .enigma2
- **Unpacking**: Manual with debugger, script-assisted

### Armadillo

- **Type**: Commercial protector (discontinued)
- **Difficulty**: Medium-Hard
- **Features**: CopyMem-II, Debug-Blocker, nanomites
- **Unpacking**: Well-documented due to age, many tutorials available

## Tools for Identification

| Tool | Platform | Description |
|------|----------|-------------|
| Detect It Easy (DIE) | Windows/Linux | Signature-based packer detector |
| PEiD | Windows | Classic PE identifier (legacy, large sig DB) |
| Exeinfo PE | Windows | Packer/compiler detector |
| pestudio | Windows | PE analysis with packer detection |
| Yara | Cross-platform | Custom rules for packer detection |
| packer_detector.py | Cross-platform | This skill's detection script |

## Quick Decision Tree

```
Is overall entropy > 7.0?
├── Yes → Likely packed
│   ├── Known section names? → Identify packer → Use specific unpacker
│   ├── EP signature match? → Identify packer → Use specific unpacker
│   └── No matches → Custom packer → Manual unpacking required
└── No
    ├── Entropy > 6.5? → Possibly obfuscated (not packed)
    └── Entropy < 6.5? → Likely not packed (check for other obfuscation)
```