# Packers and Unpacking Fundamentals

> Learn how malware packers hide executable code and how analysts identify, analyze, and unpack protected Windows binaries.

Canonical: https://codelivly.com/rooms/packers-and-unpacking-fundamentals
Last updated: 2026-09-20

| | |
|---|---|
| Level | Advanced |
| Category | Malware Analysis |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

Understand how executable packers transform malware to conceal code, reduce static visibility, and complicate reverse engineering. Learn to identify packed Windows PE files using structural indicators, section characteristics, entropy, imports, and runtime behavior. Progress from recognizing common packing techniques to understanding the unpacking workflow, including locating the original entry point, observing runtime unpacking, and recovering the protected payload. This module builds the foundation required for advanced manual unpacking and anti analysis research.

## Lessons

1. What Is Packing and Why Does It Matter? (30 min)
2. Common Packers (UPX, Themida, Custom Crypters) (30 min)
3. Manual Unpacking with a Debugger (30 min)
4. Guided Lab: Unpacking a UPX-Packed Sample (30 min)

## Related

- [Learning path: Unpacking and Anti-Analysis Evasion](https://codelivly.com/learning-paths/unpacking-and-anti-analysis-evasion)
- [All rooms](https://codelivly.com/rooms)