A packer means inject some function codes to the APP, and can be confused with the original binary instruction through virtualization and other means of equivalent transformation, to achieve a variety of APP to meet security needs. According to different functions can be divided into: compressed shell, shell encryption, virtual chassis .
Classification of a packer
Compression Shell
To hide the program codes and data for the purpose, and the hidden code and data are compressed. However, since the shell will compress the code and data segments in the reduction operation, so security is low.
Encryption shell
Compression function similar case, code and data can be encrypted, a single function may be encrypted, is decrypted only when the function is executed. Also, due to the run-time code and still need to decrypt the data, it can only play a supporting effect.
Virtual chassis
The original instructions through virtualization, translated into a custom virtual machine instructions. Since the virtual machine instructions is not open to the public, each shell can produce randomization of the virtual machine operating code, if you want to reverse instruction virtualization, you need to customize a virtual machine analysis, analysis extremely difficult.
A packer six characteristics
01 security
Virtual machine protection shell along with basic and advanced protection features, is recognized as the highest intensity of protection.
The main role of encryption is to protect the core shell code logic and software reverse increase the difficulty. High security is to choose a shell tool of the gold standard. Security can be analyzed from two aspects:
Basic protection
Basic protection refers to the protection of the whole program. Basic protection can be a large degree of convergence to improve the program to break the threshold of crack extension of time.
For native executable program concerned mainly comprising: a code segment encryption / compression, the import table protection, string encryption, encryption resources, anti-debugging, memory integrity checks and the like.
For .NET program terms including: compression / hide metadata, name confusion, anti-debugging and so on.
Advanced protection
Superior protection is a function-level protection for a specified function confusion, virtualization protection. High security, extremely difficult to crack.
02 packers after the stability program
Be sure to select the market is relatively mature product packers.
A program packers, will increase the complexity of the software. Some special treatment of the packer, is likely to cause instability in the protection program. Even after the program there will be some packers are killing anti-virus software to intercept the phenomenon. If the program after the shell is unstable, give users a great inconvenience, affect efficiency.
After 03 packers affect performance
Packers choose to support performance tuning tool.
Affect the performance of the shell of the program is reflected in two aspects, one is the impact on individual protection program performance size, and second, in the pursuit of high security at the same time, if the performance can be adjusted. It refers to a packer performance tuning of their saver performance analysis and accurately determine the performance bottlenecks. After protection program performance diagnosis will take up a developer a lot of time, if we can easily diagnose performance bottlenecks in the process of protection can significantly enhance the development efficiency.
04 support range
Choose to support a wide range of packers tools.
Currently, the application is multi-platform development, housing support tools range can weigh from three dimensions:
CPU Architecture: supports x86, x64 and ARM 32, ARM 64 instruction set.
Operating System: support Windows, Linux, macOS, Android, ARM Linux and so on.
Program type: C / C ++, Delphi, etc. Go statically compiled language native executable program. C #, VB .NET compiler-generated program. Unity3D game programming popular program. Python, PHP and other scripting language program.
05 Data Protection
Select data protection packers tools.
In the process of loading the software needed for the operation to complete a number of important data, security data files should also be valued. Prevent leaks and damage data files in order to better implement software security. When you select a packer to look at whether to support the data file protection.
06 User Experience
Select simple products.
Interface tools: priority intuitive interface, simple operation of the product, this can be more effective, improve the efficiency of encryption.
Command line: team development processes tend to use the CI system automatically compile, and even has a dedicated team to build, so the command line shell is essential.