A C++ Windows malware analysis tool that uses memory and code hooks to detect and extract hidden code from packers.
PackerAttacker is a C++ Windows application that detects and extracts hidden code from packed malware using memory and code hooks. It helps security researchers analyze obfuscated executables by revealing the actual malicious payloads that packers attempt to conceal. The tool specifically targets common packer techniques like heap execution, PE header replacement, and process injection.
Windows malware analysts, reverse engineers, and security researchers who need to unpack and analyze obfuscated malware samples. It's particularly useful for those working with packed executables in forensic investigations.
PackerAttacker provides a lightweight, hook-based alternative to full sandbox environments for unpacking malware, offering faster analysis with lower overhead. Its focus on specific packer techniques makes it more targeted and reliable for the packer types it supports compared to generic unpacking solutions.
C++ application that uses memory and code hooks to detect packers
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Focuses on specific, real-world packer techniques such as heap execution and PE header replacement, making it highly effective for common malware evasion methods as described in the README.
Saves extracted hidden code automatically to C:\dumps, streamlining the analysis workflow by eliminating manual extraction steps.
Uses Microsoft Detours for reliable code interception, avoiding the overhead of full sandbox emulation and enabling faster analysis.
Adopts a hook-based strategy over emulation, aligning with practical malware analysis needs by directly targeting packer behaviors rather than simulating entire environments.
Only supports PE EXE files, excluding DLLs and other executable formats, which restricts its use with diverse malware samples.
Requires Microsoft C++ 2010 and the Detours library, making setup challenging on modern systems and potentially incompatible with newer toolchains.
Users must manually create folders and modify PATH variables, adding friction to deployment and reducing ease of use.