Quote:
Originally Posted by CrystalMaiden
Instant, how do you know that it's proected with xxxx/xxxx? What software to detect the protector? 
|
First you should look for a signature with a program like PEiD for example.
If that finds something you can open the target in Olly and verify if the it is right (you see it in the code, all protectors and packers have different stubs).
If the analyzing software doesn't find anything you still need to open the program in Olly (or some other debugger) and search for code that is common to the protector or packer.
Those last two things requires some reading of packer/protector code.