Executable Packing
A curated list of awesome resources (papers, tools, packers) related to executable packing, unpacking, and detection for malware analysis and cybersecurity.
What is Executable Packing?
Awesome Executable Packing is a curated GitHub repository that aggregates resources related to the packing of executable files. It compiles references to academic papers, tools, packers, and datasets used for obfuscating, compressing, or encrypting executables—often for malware evasion—and the corresponding techniques to detect and unpack them. The project serves as a knowledge base for understanding how software is protected or hidden and how security analysts can counteract these methods.
Malware researchers, reverse engineers, cybersecurity professionals, and students who need to analyze packed binaries, develop detection tools, or study software obfuscation and protection techniques.
It provides a single, organized point of access to a wide array of specialized resources that are otherwise scattered across the internet, saving time for researchers and practitioners focused on executable analysis and malware defense.
Overview
A curated list of awesome resources related to executable packing
Use Cases
Best For
- Finding academic papers on packer detection algorithms
- Locating tools for unpacking obfuscated Windows PE files
- Researching historical and modern software packers
- Studying anti-analysis techniques like anti-debugging and virtualization
- Building datasets for training machine learning models to detect packed malware
- Learning about executable file formats (PE, ELF, Mach-O) and their manipulation
Not Ideal For
- Security operations centers needing real-time threat intelligence on emerging packers
- Software developers seeking plug-and-play libraries to pack their own applications for distribution
- Beginners in reverse engineering who require structured, interactive tutorials with hands-on exercises
Pros & Cons
Pros
Aggregates hundreds of peer-reviewed papers, books, and blog posts on packing techniques and detection, with star ratings highlighting key research, as detailed in the scientific research section.
Catalogs packers by historical eras (before 2000, 2000-2010, after 2010), providing context for the evolution of obfuscation methods in malware and software protection.
Includes resources for PE, ELF, Mach-O, and other executable formats, making it valuable for analysts working across Windows, Linux, and macOS systems.
Curates a wide range of detection/unpacking tools and research datasets like EMBER, saving time for practitioners building or evaluating machine learning models.
Cons
Relies entirely on external URLs that may break or become outdated over time, requiring users to manually verify resource availability and relevance.
Assumes advanced familiarity with malware analysis concepts, offering no introductory guides or explanations, which can overwhelm newcomers.
While curated, it lacks ratings or reviews for listed resources, forcing users to sift through vast entries to identify the most reliable or effective tools and papers.
Functions solely as a reference list without integrated tools, community forums, or update mechanisms, limiting its utility for collaborative or dynamic research needs.
Frequently Asked Questions
Related Projects
HackingA curated list of awesome Hacking tutorials, tools and resources
SecurityA collection of awesome software, libraries, documents, books, resources and cools stuffs about security.
Malware AnalysisDefund the Police.
Web Security🐶 A curated list of Web Security materials and resources.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.