What problem does it solve? When analyzing an unknown binary, you must first determine whether it is packed and which packer was used before choosing an unpacking strategy. This Skill provides a structured identification workflow combining signature scanning, section-name inspection, entry-point analysis, entropy measurement, and import-table checks so you avoid misjudging packed samples as clean or vice versa. ## Core Features & Use Cases - Signature-based detection: Scan samples with Detect It Easy (diec) and PEiD to identify known packers such as UPX, ASPack, FSG, VMProtect, and Themida. - Multi-feature cross-validation: Combine section names, entry-point location, entropy above 7.0 bits/byte, and minimal import tables to detect unknown or signature-missing packers. - OEP clue recording: Capture entry-point instructions (e.g., pushad) and addresses during identification for later use with the ESP law during unpacking. - Use Case: You receive a suspicious PE sample with almost no readable strings. Run the workflow to confirm it is packed, identify it as UPX 3.x, record the entry instructions, and route it to the simple unpacking path. ## Quick Start Analyze the attached sample.exe to determine whether it is packed, identify the packer name and version, and record entry-point clues for unpacking.
