Obfuscation, Packers, and Crypters
- Packer: compresses/encrypts the real code; a stub unpacks it into memory at runtime. Examples: UPX (simple, reversible), Themida/VMProtect (heavy, anti-analysis).
- Crypter: encrypts a payload specifically to defeat AV signatures (FUD = "fully undetectable" is the marketing claim).
- String encryption: strings decrypted only at use — static
stringsshows nothing useful. - Control-flow flattening: rewrites logic into one big switch/dispatcher loop so the flow is unreadable.
Key Takeaway
Obfuscation raises the cost of static analysis. It rarely survives execution — the code must eventually run in the clear.