Antivirus bypass using packing
Packers are programs that are used most of the time to compress code in binary files (mostly EXE files). While these programs are not, in themselves, harmful and can in fact be used for a variety of useful purposes, malware authors tend to use packers to hide their code's intentions, making malware research more difficult and potentially aiding their code in thwarting static antivirus engines. This section of the book will present the major differences between regular and packed executables, explore how to detect packers, and explain how to defeat them. Central to this task is understanding the importance and maintenance of unpacking engines used by various types of antivirus software.
How packers work
To explain how packers work, we will run a simple "Hello World.exe
" file through two different packers, Ultimate Packer for eXecutables (UPX) and ASPack, each of which uses a different packing technique.
In general, packers work...