## Unpacking & Anti-Analysis

Most malware is "Packed" (Compressed/Encrypted) to hide from AV signatures.

### The Packer Lifecycle
1.  **The Stub**: The small piece of code you actually see.
2.  **Unpacking**: The Stub decrypts the *real* malware (Payload) from its data section and writes it into memory.
    *   *Technique*: Uses `VirtualAlloc` (Get memory) -> `RtlDecompressBuffer` -> `VirtualProtect` (Make executable).
3.  **Transfer (OEP)**: The Stub jumps to the **Original Entry Point** (OEP) of the payload.
4.  **Execution**: The real malware runs.

### Manual Unpacking Technique
1.  Load packed malware into x64dbg.
2.  Set breakpoints on `VirtualAlloc` and `VirtualProtect`.
3.  Run code. It breaks when it allocates memory.
4.  Watch that memory region. Step over until you see the PE Header (`MZ`) appear in the memory dump.
5.  **Dump It**: Use "Scylla" (plugin) to save that memory region to a file (`unpacked.exe`).
6.  Now open `unpacked.exe` in Ghidra. You will see the real strings and logic.

### Dealing with Obfuscation
*   **Dead Code**: Junk instructions that do nothing (`ADD EAX, 0`) just to confuse you.
*   **Control Flow Flattening**: Breaking linear code into a confusing switch-statement mess.
*   **String Encryption**: Strings are stored as `XOR 0x55`. The malware decrypts them only when needed.
*   *Solution*: FLOSS (FireEye Labs Obfuscated String Solver). It runs code heuristics to find and extract obfuscated strings automatically.