Reverse Engineering PE-Packer: Windows x86 PE file packer written in C & Microsoft Assembly

[itsMe]

PE-Packer

PE-Packer is a simple packer for Windows PE files. The new PE file after packing can obstruct the process of reverse engineering.

It will do the following things when packing a PE file:

    Transforming the original import table.
    Encrypting sections.
    Clearing section names.
    Installing the shell-entry.

When running a packed PE file, the shell-entry will decrypt and load the original program as follows:

    Decrypting sections.
    Initializing the original import table.
    Relocation.

Before packing, using some disassembly tools can disassemble the executable file to analyze the code, such as IDA Pro.

To see this hidden content, you must like this content.