Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?

share|improve this question
up vote 12 down vote accepted

In some circles, "crypter" and "packer" are synonymous to mean binaries or programs which are self-checking and/or self-modifying. Crypters may, more specifically, mean self-modification that includes encryption and/or code scrambling (see more below).

I suggest that you read Chris Eagle's The IDA Pro Book for an introductory understanding of packers and their disassembly of components and architecture.

Daniel Reynaud's work on packers and self-modifying code is also very fascinating. He makes some distinction between integrity checking, blind writes, code scrambling, and encryption of PE files in this blog post about visualizing packers and self-modifying programs. His crude system of checking for these various technique implementations in packers using dynamic binary instrumentation (not the best way of going about this, but it can be very fast compared to other methods) is available at

share|improve this answer
Thanks! Nice resources indeed. – gbr Nov 14 '10 at 14:57

You could give some of the encoders in the metasploit framework a look. In particular the Polymorphic XOR Additive Feedback Encoder ( Shikata Ga Nai ) might be worth a look, as it is dicussed in the Metasploit Unleashed documentation in regards to bypassing antivirus detection.

share|improve this answer
Thank you for the seuggestion! – gbr Nov 14 '10 at 14:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.