Modern malware needs built-in protections to evade modern endpoint and network defenses. Ideally, these protections will also impede reverse-engineering and help protect the malware’s payload and internals from investigators. One option is a packer, a tool that adds obfuscation and protection to software. Many of the malware samples you’re likely to encounter in the wild will be packed, so it’s very important to be familiar with them. This chapter will introduce various types of malware packers, their architecture, how they work, and, most importantly, how to bypass them in order to access the malicious code ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month, and much more.
