Saturday, 30 March 2013

How to Disguise Packer


PEiD is a tool to identify a PE file, inside contained entrypoint, file offset, linker info, and include packer used. However, the results are displayed also not absolutely true. We will show you how to change the name of a packer.


Examples of programs that will be used for conversion packernya is OllyDbg, and the program used to change packernya is EXEForger.

First, open OllyDbg with PEiD (Hardcore Scan)

It can be seen that OllyDbg dipack with UPX

Next we try to disguise it, open OllyDbg with EXEForger, select false packer to be used, and then click Apply Open the target

Next we try to open it again with PEiD

Camouflaged not mean it can not be dismantled :)
Happy studying and hopefully always helpful ^ _ ^

0 comments:

Post a Comment