Generic Unpacker of Executable Files
Marek Milkovi · 2015
Executable file packing is a process used for compression or protection of these files. The behavior and intent of such packed executable files is difficult or even impossible to analyze. If we want to analyze the original code, we need to detect the used packer and unpack the executable file with a tool called unpacker. This paper describes the methods used for packing and unpacking of the executable files as well as the implementation of an easily and quickly extensible unpacker, which is going to be used in a decompiler developed by AVG Technologies. This unpacker provides the interface for plugins, which extend the set of supported packers. Unpacking plugins aim at the methods for unpacking without actually running the packed program; thereby providing security measures and targeting the architecture and platform independent unpacking. A newly proposed generic unpacker achieves comparable results with unpackers used in practice and even outpace them in a few aspects. It shows that even static unpacking methods can produce accurate results.