So we are taking a short break from my 4 part series on Maltego to bring you a guest post on runtime packers done by your friendly neighborhood Security Shoggoth. Packers are one of those mystical tech items out there that for most people sound too complicated to even look into. What SecShoggoth and I aimed for with this post is to have understandable yet technical and I think he did an awesome job:
What is a packer?
What do they do?
A packer, also known as a run time packer, is a program which compresses another executable to a smaller size on disk. When executed, the packed executable is uncompressed in memory and executes. The time to uncompress the executable in memory is usually not noticeable, making it very advantageous to use one.
There are hundreds of packing programs available. One of the most commonly used is UPX (http://upx.sourceforge.net) which will pack a number of executable formats. Unlike most packers, UPX can unpack a program to its original, uncompressed state. Many packers do not have this functionality and analysts who wish to unpack a program have to find a separate unpacker or manually unpack the program in a debugger.
Why do virus/malware developers use them?
There is one side effect of packers that malware developers have found useful. Not only does the packer make the malware smaller and easier to transfer, but they also obfuscate or encrypt the internal components of the malware making static analysis virtually impossible.
For example, normally an analyst would be able to look at the internal strings of a malware sample and determine some of its functionality - such as what registry keys it adds, what URLs it contacts, what functions it loads, etc. However, by using a packer on the malware, the internal strings would be compressed and obfuscated, hiding them from view. The only way to view to internal strings would be to unpack the malware - something which is not always an easy thing to do.
Some packers also contain anti-virtual machine, anti-sandboxing and anti-debugging “features” which prevent the packed executable from running if it detects any software analysts typically use to analyze malware. This makes it much harder for the malware to be analyzed and will extend the amount of time before it can be reliably detected by AV software.
How do they work?
When an executable is packed, the packer compresses the original program and places some wrapper code around it. When the packed program is executed, this wrapper code runs and uncompresses the original program in memory, loads any dynamic libraries needed by the import table and jumps to the original entry point (OEP) of the now uncompressed program where it begins execution.
Continue reading "Runtime Packers - hold the cheese"
About Me
Rob (mubix) Fuller - Security Addict that is hell-bent on making his career path useless - Call 202-658-7730
Read More
