Major modifications in the file, especially in the PE file header, have been made by the packer. To better understand how packers work, let us compare the host and the packed version of the executable file. Using the CFF tool, let us inspect the header differences.
The figure above shows the NT header difference between the original and the UPX packed version:
The only difference here is the number of sections, which was reduced from four down to three, as demonstrated by the following example:
In the optional ...
