Executable Packing

A curated list of awesome resources, tools, and literature on executable packing, unpacking, and detection for malware analysis and cybersecurity.

A curated collection of LLVM-based tools, compilers, and resources focused on security, obfuscation, binary lifting, and compiler development.

A mirror of Apple's official documentation describing the Mach-O file format used for macOS and iOS executables.

A collection of OllyDbg scripts for unpacking and analyzing software protections in reverse engineering.

Evaluates packer detection tools pypeid and Detect It Easy (DIE) on malware datasets to compare accuracy and false positive rates.

A detailed guide and implementation for a simple PE file packer that encrypts executable sections and adds an unpacking stub.

An open dataset for learning-based temporal analysis of PE malware, containing over 130,000 Windows PE files with feature vectors and metadata.

A dataset of ELF files packed with various packers for training machine learning models on executable packing detection.

A curated dataset of packed and unpacked PE executables for training machine learning models to detect packing.

An open dataset and toolkit for training static PE malware machine learning models, featuring millions of labeled Windows executable samples.

A benchmark dataset with 3.2 million malicious and benign files across 6 file types for evaluating malware classifiers.

Scripts to create malware analysis datasets in the same format as the FFRI Dataset, extracting features from executable files.

A curated dataset of 1,044,394 Windows executable samples with frequency-domain image representations for malware detection research.

A collection of real-world malware samples, analysis exercises, and training resources for cybersecurity education and research.

A dataset of PE files packed with various packers for malware analysis and security research.

A research project investigating how packers affect the accuracy of static machine-learning malware classifiers.

A collection of reverse engineering challenges including crackmes, keygenmes, and serialmes for educational purposes.

A live malware repository providing encrypted samples and source code for educational malware analysis and research.

A reflective PE packer for in-memory execution of Windows executables to bypass security products.

A packer utility for compressing, obfuscating, and protecting native Windows executables and DLLs.

A low-level mutator for Windows PE files that obfuscates headers and metadata to break static analysis signatures without breaking execution.

A Golang packer that uses process hollowing to hide payloads within legitimate processes.

Android app protector using second-generation hardening technology to load encrypted dex files from memory dynamically.

An open-source protector for .NET applications that obfuscates code and prevents reverse engineering.

A compressing linker for creating extremely small Windows demoscene executables (1k/4k/8k intros).

Encrypts 64-bit ELF files with self-decryption at runtime for binary protection.

A polymorphic runtime cryptor that XOR-encrypts the .text section of x86_64 ELF binaries on Linux, changing the hash on each execution.

A simple ELF crypter that encrypts ELF binary sections using RC4 encryption for on-disk protection.

An ELF packer for i386 executables that compresses and encrypts binary files.

A Windows executable packer that compresses 32-bit EXE files to reduce their size.

A simple Linux ELF runtime crypter that encrypts and loads executables directly into memory to evade detection.

A PE packer that compresses executables with Huffman encoding and encrypts them with XOR, executing directly from memory.

A collection of security tools, exploits, proof-of-concept code, shellcodes, and scripts for educational purposes.

A modern packer for ELF binaries that encrypts Linux executables using XOR, NOT, and complex encryption methods.

A proof-of-concept .NET executable packer that demonstrates runtime packing principles without native code.

A library for ELF binary obfuscation using on-the-fly encryption with PRESENT and blake244.

A packer that compresses and encrypts .NET assemblies, storing payloads within PE file structures.

A Go-based binary packer that compresses, encrypts, and protects ELF binaries, scripts, and AppImages from tampering and reverse engineering.

An in-memory packer for macOS Mach-O bundles that applies reversible transformations for obfuscation.

A permissively-licensed packer that compresses executables, reduces their size, and provides basic anti-debugging protection.

A packer for Windows x86 executable files that transforms and encrypts PE files to obstruct reverse engineering.

A PE file packer that adds a custom shell to executable files for protection and modification.

A simple PE file packer that encrypts the .text section with XOR encryption and adds a decryption stub.

An open-source packer that converts executables and shellcode into stealthy, evasive payloads for Windows.

A proof-of-concept crypter for GNU/Linux ELF64 binaries that encrypts and decrypts code segments at runtime.

A multi-packer wrapper for daisy-chaining packers, obfuscators, and shellcode loaders to protect Red Team implants with watermarking and IOC collection.

A tool for creating compressed ELF executables to run on the PlayStation 2, similar to UPX.

An ELF/PE binary packer written in pure C for obfuscation and reverse engineering protection.

A simple PE32 executable packer using aPLib compression library for Windows.

A simple Windows EXE packing tool for learning and investigating PE file structure.

A Windows x86 PE packer written in pure C/C++ that implements a linker for repackaging executables with in-memory decompression.

ELF runtime packer that creates self-protecting binaries by loading executables in-memory to evade detection.

An ELF packer that encrypts the .text section of executables and injects self-decryption shellcode, printing '....WOODY....' upon execution.

A simple packer that encrypts Windows PE executables using XOR encryption and Base64 encoding.

A MASM-based x86 packer implementing process hollowing and NTDLL remapping for payload protection.

An extensible ELF64 packer for Linux x86_64 and AArch64, featuring 22 compression codecs, EXE filters, and ML-driven codec selection.