PyPackerDetect 
Detect packers on PE files using heuristics and signatures.
A complete refactoring of this project to a Python package with a console script to detect whether an executable is packed.
pefile is used for PE parsing. peid is used as implementation of PEiD.
$ pip install pypackerdetect
$ pypackerdetect --help
[...]
usage examples:
- pypackerdetect program.exe
- pypackerdetect program.exe -b
- pypackerdetect program.exe --low-imports --unknown-sections
- pypackerdetect program.exe --imports-threshold 5 --bad-sections-threshold 5
Detection Mechanisms
- PEID signatures
- Known packer section names
- Entrypoint in non-standard section
- Threshhold of non-standard sections reached
- Low number of imports
- Overlapping entrypoint sections
Related Projects
You may also like these:
- Awesome Executable Packing: A curated list of awesome resources related to executable packing.
- Bintropy: Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes (inspired from this paper).
- Dataset of packed ELF files: Dataset of ELF samples packed with many different packers.
- Dataset of packed PE files: Dataset of PE samples packed with many different packers (fork of this repository).
- Docker Packing Box: Docker image gathering packers and tools for making datasets of packed executables.
- DSFF: Library implementing the DataSet File Format (DSFF).
- PEiD: Python implementation of the well-known Packed Executable iDentifier (PEiD).
- REMINDer: Packing detector using a simple heuristic (inspired from this paper).
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file pypackerdetect-1.1.4.tar.gz.
File metadata
- Download URL: pypackerdetect-1.1.4.tar.gz
- Upload date:
- Size: 341.1 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
38b694d43ae3d29ab378dac0f15b33d78b56e870c9ea6b8cc99eba75bb3babbe
|
|
| MD5 |
3f82bcf561dbd52bbae49281f6aecf23
|
|
| BLAKE2b-256 |
4775b5d462a11a1eb884920857be695aee458f7e1ac563521722c3a1e013547c
|
Provenance
The following attestation bundles were made for pypackerdetect-1.1.4.tar.gz:
Publisher:
python-package.yml on packing-box/pypackerdetect
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
pypackerdetect-1.1.4.tar.gz -
Subject digest:
38b694d43ae3d29ab378dac0f15b33d78b56e870c9ea6b8cc99eba75bb3babbe - Sigstore transparency entry: 2498794676
- Sigstore integration time:
-
Permalink:
packing-box/pypackerdetect@059d699ef40129b7712ccfd96a57a0037cb17ffd -
Branch / Tag:
refs/heads/main - Owner: https://github.com/packing-box
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
python-package.yml@059d699ef40129b7712ccfd96a57a0037cb17ffd -
Trigger Event:
push
-
Statement type:
File details
Details for the file pypackerdetect-1.1.4-py3-none-any.whl.
File metadata
- Download URL: pypackerdetect-1.1.4-py3-none-any.whl
- Upload date:
- Size: 311.8 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
c9b73c555868c74d61749b7d10149e29afb4a99f0f9a1f8d8cb2993e7507b299
|
|
| MD5 |
6128056e5e66871b5ab99ab13a1ad206
|
|
| BLAKE2b-256 |
0b45cb1785ed36052d70cc42ff08908eaaaa27f5b92d14343754c14ca200a045
|
Provenance
The following attestation bundles were made for pypackerdetect-1.1.4-py3-none-any.whl:
Publisher:
python-package.yml on packing-box/pypackerdetect
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
pypackerdetect-1.1.4-py3-none-any.whl -
Subject digest:
c9b73c555868c74d61749b7d10149e29afb4a99f0f9a1f8d8cb2993e7507b299 - Sigstore transparency entry: 2498794681
- Sigstore integration time:
-
Permalink:
packing-box/pypackerdetect@059d699ef40129b7712ccfd96a57a0037cb17ffd -
Branch / Tag:
refs/heads/main - Owner: https://github.com/packing-box
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
python-package.yml@059d699ef40129b7712ccfd96a57a0037cb17ffd -
Trigger Event:
push
-
Statement type:
