What is a software packer?

You can imagine a program packed by a software packer will be protected or compressed and wrapped in a shell so that its internal contents are not directly visible to analysts. As usual, we’ll use a memory distribution figure to give you a quick overview of how packing technology has been implemented. Figure 8.1 shows the distribution of msgbox.exe in the dynamic phase before (left side) and after (right side) the software was packed:

Figure 8.1 – Difference in memory before and after packing

The left-hand side of the figure shows the memory distribution of the msgbox.exe executable after file mapping, which we mentioned in Chapter 7. We can see that the current image base of the executable is mounted at 0x400000, and the entire PE module is allocated a total of 0x307A bytes in memory. The .text section, which holds the code, is currently placed at 0x401000 to 0x401FFF; the .data section, which holds the data, is...