sys packer

hi,

Looking for a drivers (sys-files) packer. Found nothing yet. Can anybody help with any links (theoretical material maybe)?

will be really appreciate for any help.

[orfei]

VMProtect support .sys file packing.

only VMProtect, nothing else?

[Ember]

Code Virtualizer will VM them but no packing.

[memcpy]

TDL malware .sys drivers are packed, but this packer is probably private.

[SLV]

There is nothing difficult to pack sys images. But there are a few rules: the result should have a valid OptionalHeader.Checksum (MapFileAndCheckSum), take a look for sections attributes (if the section is non paged, use NonPagedPool for avoid BSOD), kernelmode SEH's are work only if exception handler points to code section (if your packer will move original image somewhere), MmGetSystemRoutineAddress doesn't work with NDIS API's, etc.

[OHPen]

I also recommend code virtualizer. its doing a quite nice job.