What is packing: Details of packing

To explain it simply, the main thing is virus packing, that is, the original virus or Trojan horse is added to some ** so that it can evade the detection and killing of antivirus software, which is called packing.

Add some special ** to the computer program so that viruses cannot enter the program. There are also virus packing, so that the antivirus software can't find it**.

The concept of shell:

The so-called "round shell" is a special tool for compression.

The compression here is not the compression of the noisy tools we usually use RAR, ZIP, the compression of the shell refers to the compression of program files such as exe, com, and dll, and add a paragraph like a protective layer to the program, so that the original program file ** loses its original appearance, so as to protect the program from being illegally modified and decompiled, this section is like a protective layer, and the shell of animals and plants in nature has many similarities in function, so we call it the shell of the program figuratively.

The role of the shell:1Protects the program from unauthorized modification and decompilation.

2.The program is specially compressed to reduce the file size and facilitate distribution and storage.

The difference between shell and compression software for compression is:

Compression software can only compress crash programs.

The program files such as exe, com, and dll can run like normal programs after shell compression.

Another commonly used method of packing: to implant a paragraph of ** in the binary program, and to give priority to the control of the program when it is running, and to do some extra work. Most viruses are based on this principle.

Packed programs often try their best to prevent external programs or software from disassembling or dynamic analyzing the shell programs in order to achieve their ulterior purposes. This technique is also commonly used to protect software copyrights from being cracked by software.

The packer adds a command to the file header to tell the CPU how to decompress itself. The CPUs are all very fast nowadays, so you can't see anything in this decompression process. The software opens at once, and only if your machine configuration is very poor, you will feel the difference in the speed of the software without packing and after packing.

When you shell, you're putting a cloak on the executable file. All the user is executing is this shell. When you execute this program, the shell will unravel the original program in memory, and after unlocking, the future will be handed over to the real program.

So, these jobs just run in memory. Shell encryption usually refers to a lot of free or non-free software on the Internet, which is packed by some special packing programs, which is basically compression or non-compression of the program. Because sometimes the program will be too large and need to be compressed.

However, most of the programs are because they prevent anti-tracking, prevent the program from being tracked and debugged, and prevent the algorithm program from not wanting to be statically analyzed by others. Encrypt** and data to protect the integrity of your program data. Don't be modified or peek inside your program.

Although adding "shell" increases the burden on the CPU, it reduces the read and write time of the hard disk, and the program runs faster after adding "shell" in actual application (of course, some will be slower after adding "shell", which is the problem of the selected "shell" tool).

Generally, the software is added with a "shell", which can not only protect your software from being cracked or modified, but also increase the startup speed of the runtime.

Adding a "shell" is not the same as a Trojan horse, and most of our usual software has added its own dedicated "shell".

RAR and ZIP are both compression software, not "shell" tools, they need to read and write disk when decompressing, and the decompression of "shell" is carried out directly in memory. If you try to compress a virus with RAR or ZIP, the antivirus software will definitely find it when you unzip it. And if you use the "shell" method to package the Trojan horse, the antivirus software that can be found is much less stupid and faster.

The principle of Trojan packing is very simple, many of the multi-band Trojans provided in the hacker camp have been processed, and these treatments are called packing. When a program is generated, it is easy to modify it using tools such as resource tools and disassembly tools, but if the programmer adds a shell to the program, then at least the shelled program is not so easy to modify, and if you want to modify it, you must first unwrap it. Packing tools are usually divided into two categories: compressed shells and encrypted shells.

The point of compression shell is to reduce the size of the software, and encryption protection is not the focus.

There are many types of encrypted shells, and different shells have different focuses, some shells simply protect the program, while others provide additional functions, such as providing registration mechanisms, the number of uses, time limits, etc.