Executable files can have the code packed, encrypted and obfuscated but remain executable with all of the program intact. These techniques are primarily aimed at protecting the program from being reversed. The rule is that if the original program works properly, it can be reversed. For the rest of the chapter, we will define the term host or original program as the executable file, data, or code before it gets packed, encrypted, obfuscated or protected.
Packers, also known as compressors, are tools used to compress the host down to a smaller size. The concept of compressing data helps us to reduce the time taken to transfer any data. At the obfuscation side, compressed data will most likely not show complete readable text.
In the following figure, the left pane shows the code's binary and data before getting compressed, while the one on the right shows its compressed form. Notice that the text strings are not completely...
