---

How to Write Your Own Packer

2

1 Intro

2

2 What You're Getting Into

2

3 Big Picture

2

4 First Step

3

5 Next Step

3

6 Continuo

3

7 A Stub That Runs

3

8 Choice of Compressor

4

9 Runtime dependencies

5

10 Making a Trivial C Runtime to Link Instead of the Proper One

5

11 Unpacking Stub Responsibilities

6

12 Packer Parameter Globals

6

13 Computing the Load Address

7

14 Decompressing the Original Data

7

15 Performing Relocation Fixups

8

16 Resolving Imports

9

17 Supporting TLS

9

18 Last Bit for DLL Support

11

19 Afterthoughts on Stubs

11

20 What's Next

11

21 Continuo

11

22 First Things

11

<table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-11.html"> 22.1 Project Configuration</a> </span> </td> <td class="tocItemNumber">11</td> </tr> </table> <table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-12.html"> 22.2 Utility Code</a> </span> </td> <td class="tocItemNumber">12</td> </tr> </table>

23 Basic Tasks

12

24 Details

13

<table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-13.html"> 24.1 Determine Size of Original</a> </span> </td> <td class="tocItemNumber">13</td> </tr> </table> <table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-13.html"> 24.2 Setup New Section(s); Modify Originals</a> </span> </td> <td class="tocItemNumber">13</td> </tr> </table> <table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-14.html"> 24.3 Create and Add Stub Outside this Region</a> </span> </td> <td class="tocItemNumber">14</td> </tr> </table> <table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-14.html"> 24.4 Starting to Process the Original Stub</a> </span> </td> <td class="tocItemNumber">14</td> </tr> </table> <table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-15.html"> 24.5 Merging Imports Data</a> </span> </td> <td class="tocItemNumber">15</td> </tr> </table> <table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-16.html"> 24.6 Exports</a> </span> </td> <td class="tocItemNumber">16</td> </tr> </table> <table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-17.html"> 24.7 Do Stub Fixups and Relocating the Relocations</a> </span> </td> <td class="tocItemNumber">17</td> </tr> </table> <table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-17.html"> 24.8 Setup for TLS Stuff</a> </span> </td> <td class="tocItemNumber">17</td> </tr> </table> <table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-18.html"> 24.9 Compressing the Original Data</a> </span> </td> <td class="tocItemNumber">18</td> </tr> </table> <table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-19.html"> 24.10 Processing the Resource Directory</a> </span> </td> <td class="tocItemNumber">19</td> </tr> </table> <table class="tocTable" style="margin-left: 1em;"> <tr> <td class="tocItemDots"> <hr class="dotsHR"/> <span class="tocItemTitle"> <a class="internalLink" href="./page-20.html"> 24.11 Dotting I&#39;s and Crossing T&#39;s</a> </span> </td> <td class="tocItemNumber">20</td> </tr> </table>

25 Beyond Packers

20

26 conclusions

20