How PE Sections and Entropy Reveal Packed Executables
· 13:42 · Watch on YouTube ↗
Summary
A reverse-engineering lesson compares packed and original PE files, showing how section metadata, memory mappings, entry-point information, and entropy can help identify packing and guide unpacking.
Key points
- The lesson compares a packed executable with its original and inspects PE section names, sizes, addresses, offsets, and permissions.
- The packed sample has UPX0, UPX1, and UPX2 sections; UPX0 has a raw size of zero, while UPX1 contains data and has a larger virtual size.
- The instructor uses section entropy as a clue: the packed sample’s UPX1 is reported at 7.8–7.9, while the original sample’s text section is 6.4.
- The instructor cautions that an entropy value around 7.0 is a rough indicator, not a definitive threshold.
- Entry-point and section information help the instructor assess where compressed content and possible unpacking logic may reside; some conclusions about UPX2 remain uncertain.
- When analyzing a memory dump in IDA, section offsets or PE headers may need adjustment so the disassembler looks in the correct locations.
Article Details
- Topics
- [00:37] PE section metadata, addresses, sizes, and permissions
- [03:29] Comparing on-disk sections with executable memory mappings
- [06:18] Section anomalies and preparing memory dumps for disassembly
- [07:11] UPX section layout and identifying packed content
- [09:09] Using entropy as a clue to compressed or obfuscated content
- [10:53] Interpreting entry-point and section data to assess unpacking logic
- [12:43] Comparing packed and original sample entropy