Lion Cipher Lab
Read Detect It Easy (DIE) output: is this binary packed, and what built it?
- Digital Forensics & IR (DFIR)
- Beginner
- ~30 min
- Free · no account required
Why it matters
Before an analyst opens a disassembler or runs strings, they ask one question: is this file packed? A packed executable has had its real code compressed or encrypted and wrapped in a tiny stub that unpacks it in memory at run time — so on disk there is nothing meaningful for a static tool to read. Detect It Easy answers that question in seconds by naming the compiler or packer and, above all, by measuring entropy. Learning to READ its output means you never waste an hour staring at a disassembly of packed junk, and you can tell a colleague 'this is UPX-packed, I need to unpack it first' with…
What you'll learn
- reading Detect It Easy (DIE) output field by field
- identifying the detected compiler, linker, packer and protector
- reading PE type (PE32 vs PE32+) and architecture from the output
- using per-section entropy as the packing tell (~8.0 bits/byte = compressed/encrypted)
- distinguishing a normal binary from a packed one at a glance
- judgment: when a DIE triage is the right first move, and its limits
- knowing that packing forces an unpack step before static analysis is useful
Steps in this lab
- What Detect It Easy is, and the one question it answers
- WHEN a DIE triage is the right first move
- The setting: two invented binaries in your isolated lab
- Read the NORMAL binary's report
- Read the SUSPICIOUS binary's report
- The headline: why ~8.0 bits/byte means packed
- The limits: what DIE does NOT tell you (the third rule)
- Recap: the decision you can now make