Книга: Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
Назад: Tips and Tricks for Common Packers
Дальше: Packed DLLs

), which might reveal the imported functions and other useful information.

The analysis that’s possible without fully unpacking is very limited, but depending on your goal, it may be sufficient.

Some unpackers do not actually unpack the entire original program before the program begins running. Instead, they unpack a portion of the original program, and run that portion. When it is time to run the next portion of code, that portion is unpacked into memory and run. This creates considerable overhead for the executable, but makes it very difficult for an analyst to unpack.

Reverse-engineering the technique that unpacks individual chunks of code can enable you to write a script to unpack all of the code, or at least large portions of it. Another option is to focus more on dynamic analysis.

sss
sss

© RuTLib.com 2015-2018