modify UPX

[Squidge]

Normally, the protection is done by picking unique bytes from the entry point. So, if you place another section that is executed before the normal entrypoint, it will fool detectors that do not have the "hardcore" settings. Hardcore simply searches the entire program for those signature bytes. Unfortunately, it could find them elsewhere that are nothing to do with a certain packer, and therefore identify it wrongly.

Best thing to do for just fun is to pack a program, wrap up it's unpacking code into another section, and then right a simple decryptor to put it back and call it. Nothing can identify it then (apart from someone with a debugger of course that spots your decrypting code...)

However, your not going to get very far without a good knowledge of PE files and being able to write in assembler.

Don't forget to also change the section names after packing, as some identifiers also look there.

As an example, I've made a UPX packed executable (Notepad) look like it was packed with Armadillo. Packed program still ran fine, but it could really confuse someone trying to unpack it

However, note that some packers/cryptors will not let you edit the file at all after packing, so make sure to pick a packer that doesn't mind (or better still, write your own