awesome-executable-packing
A curated list of awesome resources related to executable packing
https://github.com/packing-box/awesome-executable-packing
Last synced: 10 days ago
JSON representation
-
:books: Literature
-
Scientific Research
- Experimental toolkit for manipulating executable packing
- A fine-grained classification approach for the packed malicious code
- Generic black-box end-to-end attack against state of the art API call based malware classifiers
- Generic unpacking method based on detecting original entry point
- Highlighting the impact of packed executable alterations with unsupervised learning
- A machine-learning-based framework for supporting malware detection and analysis
- Malware detection through opcode sequence analysis using machine learning
- Metamorphic malware detection based on support vector machine classification of malware sub-signatures
- On the (Im)possibility of obfuscating programs
- OPEM: A static-dynamic approach for machine-learning-based malware detection
- Original entry point detection based on graph similarity
- Packer identification using hidden Markov model
- Pattern recognition techniques for the classification of malware packers
- PE-Miner: Mining structural information to detect malicious executables in realtime
- PEAL - Packed executable analysis
- Preprocessing of binary executable files towards retargetable decompilation
- RAMBO: Run-Time packer analysis with multiple branch observation
- Research of software information hiding algorithm based on packing technology
- Semi-supervised learning for unknown malware detection
- Source-free binary mutation for offense and defense
- Static features exploration for executable packing with unsupervised learning
- Static malware detection & subterfuge: Quantifying the robustness of machine learning and current anti-virus
- A static, packer-agnostic filter to detect similar malware samples
- A study of the packer problem and its solutions
- A survey on run-time packers and mitigation techniques
- Symbolic deobfuscation: From virtualized code back to the original
- Unpacking malware in the real world: A step-by step guide
- VABox: A virtualization-based analysis framework of virtualization-obfuscated packed executables
-
-
:package: Packers
-
After 2010
- Alienyze - Advanced software protection and security for Windows 32-bit executables.
- Alternate EXE Packer - Compression tool for executable files (type EXE) or DLL's relying on UPX 3.96.
- Amber - Position-independent(reflective) PE loader that enables in-memory execution of native PE files(EXE, DLL, SYS).
- Andromeda - Custom packer used in malware campaigns using RunPE techniques for evading AV mitigation methods.
- APKProtect - APK encryption and shell protection supporting Java and C++.
- Armadillo - Incorporates both a license manager and wrapper system for protecting PE files.
- ASPack - Advanced solution created to provide Win32 EXE file packing and to protect them against non-professional reverse engineering.
- ASProtect 32 - Multifunctional EXE packing tool designed for software developers to protect 32-bit applications with in-built application copy protection system.
- ASProtect 64 - Tool for protecting 64-bit applications and .NET applications for Windows against unauthorized use, industrial and home copying, professional hacking and analysis of software products distributed over the Internet and on any physical media.
- AxProtector - Encrypts the complete software you aim to protect, and shields it with a security shell, AxEngine, best-of-breed anti-debugging and anti-disassembly methods are then injected into your software.
- Bero - BEP (Bero EXE Packer) for 32-bit windows executables.
- BIN-crypter - EXE protection software against crackers and decompilers.
- BoxedApp Packer
- Code Virtualizer - Powerful code obfuscation system for Windows, Linux and macOS applications that helps developers to protect their sensitive code areas against Reverse Engineering with very strong obfuscation code, based on code virtualization.
- DarkCrypt - Simply and powerful plugin for Total Commander used for file encryption using 100 algorithms and 5 modes.
- DexGuard - Android app obfuscation & security protocols for mobile app protection.
- DexProtector - Multi-layered RASP solution that secures your Android and iOS apps against static and dynamic analysis, illegal use and tampering.
- DotBundle - GUI tool to compress, encrypt ad password-protect a .NET application or embed .NET libraries.
- DotNetZ - Straightforward and lightweight, command-line piece of software written in C that allows you to compress and pack Microsoft .NET Framework executable files.
- ElecKey - Suite of software and tools that offer a complete solution for software protection, copy protection, and license management.
- Enigma Protector - Professional system for executable files licensing and protection.
- Enigma Virtual Box - Application virtualization system for Windows.
- EXE Bundle - Bundles application files into a single PE32 file.
- EXE Stealth - Anti-cracking protection and licensing tool for PE files featuring compression and encryption polymorphic technology.
- Ezuri - A Simple Linux ELF Runtime Crypter.
- GzExe - Utility that allows to compress executables as a shell script.
- LIAPP - Easiest and most powerful mobile app security solution.
- LM-X License Manager - LM-X License Manager lets you protect your products against piracy by enforcing various levels of security, save time, and reduce business risks.
- MPRESS - Compresses (using LZMA) and protects PE, .NET or Mach-O programs against reverse engineering.
- .netshrink - Executable compressor for your Windows or Linux .NET application executable file using LZMA.
- NPack - Can compress 32bits and 64bits exe, dll, ocx, scr Windows program.
- Obsidium - Feature-rich professional software protection and licensing system designed as a cost effective and easy to implement, yet reliable and non-invasive way to protect your 32- and 64-bit Windows software applications and games from reverse engineering.
- PELock - Software protection system for Windows executable files ; protects your applications from tampering and reverse engineering, and provides extensive support for software license key management, including support for time trial periods.
- PEShield - PE-SHiELD is a program, which encrypts 32-bit Windows EXE files, leaving them still executable.
- PESpin
- PEtite - Free Win32 (Windows 95/98/2000/NT/XP/Vista/7/etc) executable (EXE/DLL/etc) compressor.
- RapidEXE - Simple and efficient way to convert a PHP/Python script to a standalone executable.
- Smart Packer - Packs 32 & 64bit applications with DLLs, data files, 3rd party run-time into one single executable that runs instantly, with no installs or hassles.
- Squishy - Modern packer developed for 64kb demoscene productions, targets 32bit and 64bit executables.
- Themida - From Renovo paper: Themida converts the original x86 instructions into virtual instructions in its own randomized instruction set, and then interpret these virtual instructions at run-time.
- UPX - Ultimate Packer for eXecutables.
- VMProtect - Protects code by executing it on a virtual machine with non-standard architecture that makes it extremely difficult to analyze and crack the software.
- ZProtect - Renames metadata entities and supports advanced obfuscation methods that harden protection scheme and foil reverse engineering altogether.
- PEzoNG - Framework for automatically creating stealth binaries that target a very low detection rate in a Windows environment.
- ConfuserEx - An open-source, free protector for .NET applications.
- Crinkler - Compressing linker for Windows, specifically targeted towards executables with a size of just a few kilobytes.
- ELFCrypt - Simple ELF crypter using RC4 encryption.
- ELFuck - ELF packer for i386 original version from sk2 by sd.
- Eronona-Packer - This is a packer for exe under win32.
- ASM Guard - Packer utility for compressing and complicating reversing compiled native code (native files), protecting resources, adding DRM, and packing into an optimized loader.
- ASPack - Advanced solution created to provide Win32 EXE file packing and to protect them against non-professional reverse engineering.
- ASProtect 32 - Multifunctional EXE packing tool designed for software developers to protect 32-bit applications with in-built application copy protection system.
- ASProtect 64 - Tool for protecting 64-bit applications and .NET applications for Windows against unauthorized use, industrial and home copying, professional hacking and analysis of software products distributed over the Internet and on any physical media.
- Astral-PE - Low-level mutator (Headers/EP obfuscator) for native Windows PE files (x32/x64).
- BIN-crypter - EXE protection software against crackers and decompilers.
- BoxedApp Packer
- ELF Packer - Encrypts 64-bit elf files that decrypt at runtime.
- hXOR-Packer - PE packer with Huffman compression and XOR encryption.
- Hyperion
- LM-X License Manager - Lets you protect your products against piracy by enforcing various levels of security, save time, and reduce business risks.
- m0dern_p4cker - Just a modern packer for elf binaries ( works on Linux executables only ).
- MidgetPack - ELF binary packer, such as burneye, upx or other tools.
- NetCrypt - A proof-of-concept packer for .NET executables, designed to provide a starting point to explain the basic principles of runtime packing.
- Obsidium - Feature-rich professional software protection and licensing system designed as a cost effective and easy to implement, yet reliable and non-invasive way to protect your 32- and 64-bit Windows software applications and games from reverse engineering.
- Origami - Packer compressing .net assemblies, (ab)using the PE format for data storage.
- OS-X_Packer - Binary packer for the Mach-O file format.
- Pakkero - Binary packer written in Go made for fun and educational purpose.
- Pakr - In-memory packer for macOS Mach-O bundles.
- Papaw - Permissively-licensed packer for ELF executables using LZMA Zstandard or Deflate compression.
- PE-Packer - Simple packer for Windows 32-bits PE files.
- PE-Toy - A PE file packer.
- PELock - Software protection system for Windows executable files ; protects your applications from tampering and reverse engineering, and provides extensive support for software license key management, including support for time trial periods.
- PePacker - Simple PE Packer Which Encrypts .text Section I release a simple PE file packer which encrypts the .text section and adds a decryption stub to the end of the last section.
- PEzor - Open-Source Shellcode & PE Packer.
- ProtectMyTooling - Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry.
- Silent-Packer - Silent Packer is an ELF / PE packer written in pure C.
- Simple-PE32-Packer - Simple PE32 Packer with aPLib compression library.
- SimpleDPack - A very simple windows EXE packing tool for learning or investigating PE structure.
- Smart Packer - Packs 32 & 64bit applications with DLLs, data files, 3rd party run-time into one single executable that runs instantly, with no installs or hassles.
- theArk - Windows x86 PE Packer In C++.
- VirtualMachineObfuscationPoC - Obfuscation method using virtual machine.
- Ward - Simple implementation of an ELF packer that creates stealthy droppers for loading malicious ELFs in-memory.
- Woody Wood Packer - ELF packer - encrypt and inject self-decryption code into executable ELF binary target.
- xorPacker - Simple packer working with all PE files which cipher your exe with a XOR implementation.
- ZProtect - Renames metadata entities and supports advanced obfuscation methods that harden protection scheme and foil reverse engineering altogether.
- Armadillo - Incorporates both a license manager and wrapper system for protecting PE files.
- EXE Stealth - Anti-cracking protection and licensing tool for PE files featuring compression and encryption polymorphic technology.
- zELF - A modular ELF64 packer for Linux x86_64 featuring 22 compression codecs, ML-based codec selection, and support for both static and PIE binaries.
- Backpack
- ELF-Encrypter - Collection of programs to encrypt ELF binaries using various algorithms.
- ELF-Packer - Simple Polymorphic x86_64 Runtime Code Segment Cryptor.
- ELFkickers - A collection of programs that access and manipulate ELF files.
- EXE Bundle - Bundles application files into a single PE32 file.
- oplzkwp - Library for ELF obfuscation ; it uses PRESENT and blake244 to encrypt your payload on the fly.
- pocrypt - Naive Proof of Concept Crypter for GNU/Linux ELF64.
- ps2-packer - Create packed ELF files to run on the PS2.
- sherlocked
- XyrisPack
- Smart Packer - Packs 32 & 64bit applications with DLLs, data files, 3rd party run-time into one single executable that runs instantly, with no installs or hassles.
- EXE Bundle - Bundles application files into a single PE32 file.
- Alienyze - Advanced software protection and security for Windows 32-bit executables.
- Andromeda - Custom packer used in malware campaigns using RunPE techniques for evading AV mitigation methods.
- APKProtect - APK encryption and shell protection supporting Java and C++.
- AutoIT - Legitimate executable encryption service.
- BangCle - Protection tool using the second generation Android Hardening Protection, loading the encrypted DEX file from memory dynamically.
- BoxedApp Packer
- DexGuard - Android app obfuscation & security protocols for mobile app protection.
- ElecKey - Suite of software and tools that offer a complete solution for software protection, copy protection, and license management.
- ELF-Packer - Simple Polymorphic x86_64 Runtime Code Segment Cryptor.
- Enigma Protector - Professional system for executable files licensing and protection.
- GzExe - Utility that allows to compress executables as a shell script.
- hXOR-Packer - PE packer with Huffman compression and XOR encryption.
- LIAPP - Easiest and most powerful mobile app security solution.
- PE-Packer - Simple packer for Windows 32-bits PE files.
- PE-Toy - A PE file packer.
- RapidEXE - Simple and efficient way to convert a PHP/Python script to a standalone executable.
- SimpleDPack - A very simple windows EXE packing tool for learning or investigating PE structure.
-
Before 2000
- 32Lite - Compression tool for executable files created with Watcom C/C++ compiler.
- 624 - COM packer that can compress COM programs shorter than 25000 bytes.
- aPack - 16-bit real-mode DOS executable ( .EXE and .COM ) compressor.
- AVPack - Encrypts EXE or COM files so that they'll be able to start on your PC only.
- AXE - Program compression utility.
- CauseWay Compressor - DOS EXE compressor.
- CEXE - Compresses an input EXE into a smaller executable (only runs on WinNT, Win2000 and above - won't run on Win95 or Win98).
- EPack - EXE and COM file compressor ; works with DOS/Windows95 files.
- Fire-Pack
- LGLZ - DOS EXE and COM file compressor using modified LZ77.
- Megalite - MS-DOS executable file compressor.
- Morphine - Application for PE files encryption.
- Neolite - Compresses Windows 32-bit EXE files and DLLs.
- PACK - Executable files compressor.
- Pack-Ice
- PCShrink - Windows 9x/NT executable file compressor relying on the aPLib compression library.
- PE Diminisher - Simple PE packer relying on the aPLib compression library.
- PE-Protector - Encrypter/protector for Windows 9x/ME to protect executable files PEagainst reverse engineering or cracking with a very strong protection.
- PEBundle - Physically attaches DLL(s) to an executable, resolving dependencies in memory.
- PEPack - PE compression tool based on the code of a newer version of PE-SHiELD.
- Pro-Pack - DOS executable file compressor.
- RERP - ROSE's EXE Relocation Packer.
- RJCrush - EXE and COM files compressor with the ability to compress overlays.
- SecuPack - Win32 executable compressor.
- Shrinker - Compresses (up to 70%) 16 and 32 bit Windows and real mode DOS programs.
- SPack
- SysPack - Device drivers compressor.
- T-Pack - Executable COM-FILE compressor (LZ77) optimized for small files like BBS-Addys or similar files.
- TinyProg - EXE and COM programs compressor.
- Vacuum - Runtime Compressor for DOS32 executables.
- WinLite - Compresses Windows executables (such as Pklite, Diet or Wwpack) for executables programs under DOS.
- XPA - DOS executable packer.
- SecuPack - Win32 executable compressor.
- CauseWay Compressor - DOS EXE compressor.
- PEBundle - Physically attaches DLL(s) to an executable, resolving dependencies in memory.
- XPA - DOS executable packer.
- Neolite - Compresses Windows 32-bit EXE files and DLLs.
- ABK Scrambler - COM file scrambler and protector recoded from ABKprot.
- AEP - Addition Encode-Protective for COM and EXE file.
- AINEXE - DOS executable packer (part of the AIN Archiver suite).
- CC Pro - COM and EXE executable file compression utility.
- Gardian Angel - COM and EXE encrypter and protector using a variety of anti-debugging tricks.
- JMCryptExe - DOS EXE encrypter.
- SysPack - Device drivers compressor.
- T-Pack - Executable COM-FILE compressor (LZ77) optimized for small files like BBS-Addys or similar files.
- Vacuum - Runtime Compressor for DOS32 executables.
- AXE - Program compression utility.
- 32Lite - Compression tool for executable files created with Watcom C/C++ compiler.
- CEXE - Compresses an input EXE into a smaller executable (only runs on WinNT, Win2000 and above - won't run on Win95 or Win98).
- EPack - EXE and COM file compressor ; works with DOS/Windows95 files.
- Megalite - MS-DOS executable file compressor.
- PACK - Executable files compressor.
- PCShrink - Windows 9x/NT executable file compressor relying on the aPLib compression library.
- PEPack - PE compression tool based on the code of a newer version of PE-SHiELD.
-
Between 2000 and 2010
- 20to4 - Executable compressor that is able to stuff about 20k of finest code and data into less than 4k.
-
Programming Languages
Categories
Sub Categories
Keywords
malware-analysis
11
malware-research
9
reverse-engineering
9
binary-analysis
6
python
5
malware
5
machine-learning
4
pe-file
4
packer
4
unpacker
4
security
3
windows
3
pe-format
3
dotnet
3
elf
3
android
3
elf-binaries
3
upx
3
malware-packers
3
executable-packing
3
pe
2
samples
2
yara
2
packers
2
pe-files
2
portable-executable
2
elf-format
2
c
2
malware-detection
2
x86-64
2
qemu
2
dataset
2
pefile
2
mach-o
2
analysis
2
encryption
2
lief
2
disassembler
2
deobfuscator
2
malware-samples
2
dumper
2
entropy
2
malwareanalysis
2
static-analysis
1
windowsdriver
1
dnlib
1
aarch64
1
arm
1
decompile
1
decompiler
1