Executable Packing

A curated list of awesome resources, tools, and literature on executable packing, unpacking, and detection for malware analysis and cybersecurity.

A curated collection of LLVM-based tools, compilers, and resources focused on security, obfuscation, binary lifting, and compiler development.

A mirror of Apple's official documentation describing the Mach-O file format used for macOS and iOS executables.

A collection of OllyDbg scripts for unpacking and analyzing software protections in reverse engineering.

An open dataset for learning-based temporal analysis of PE malware, containing over 130,000 Windows PE files with feature vectors and metadata.

An open dataset and toolkit for training static PE malware machine learning models, featuring millions of labeled Windows executable samples.

A benchmark dataset with 3.2 million malicious and benign files across 6 file types for evaluating malware classifiers.

A collection of real-world malware samples, analysis exercises, and training resources for cybersecurity education and research.

A research project investigating how packers affect the accuracy of static machine-learning malware classifiers.

A live malware repository providing encrypted samples and source code for educational malware analysis and research.

A reflective PE packer for in-memory execution of Windows executables to bypass security products.

A packer utility for compressing, obfuscating, and protecting native Windows executables and DLLs.

A low-level mutator for Windows PE files that obfuscates headers and metadata to break static analysis signatures without breaking execution.

Android app protector using second-generation hardening technology to load encrypted dex files from memory dynamically.

An open-source protector for .NET applications that obfuscates code and prevents reverse engineering.

A compressing linker for creating extremely small Windows demoscene executables (1k/4k/8k intros).

A simple ELF crypter that encrypts ELF binary sections using RC4 encryption for on-disk protection.

A simple Linux ELF runtime crypter that encrypts and loads executables directly into memory to evade detection.

A PE packer that compresses executables with Huffman encoding and encrypts them with XOR, executing directly from memory.

A collection of security tools, exploits, proof-of-concept code, shellcodes, and scripts for educational purposes.

A library for ELF binary obfuscation using on-the-fly encryption with PRESENT and blake244.

A packer that compresses and encrypts .NET assemblies, storing payloads within PE file structures.

A Go-based binary packer that compresses, encrypts, and protects ELF binaries, scripts, and AppImages from tampering and reverse engineering.

A packer for Windows x86 executable files that transforms and encrypts PE files to obstruct reverse engineering.

An open-source packer that converts executables and shellcode into stealthy, evasive payloads for Windows.

A multi-packer wrapper for daisy-chaining packers, obfuscators, and shellcode loaders to protect Red Team implants with watermarking and IOC collection.

A tool for creating compressed ELF executables to run on the PlayStation 2, similar to UPX.

An ELF/PE binary packer written in pure C for obfuscation and reverse engineering protection.

A simple Windows EXE packing tool for learning and investigating PE file structure.