In the slide 9, they show the frequency of each 16-bit value. In a compressed code, the frequency of each value should be almost equal.
10 or 20 years ago, when reverse engineering any unknown file it was a good to assume it was no compressed and you could get some insight looking at the hex editor and hopping the best. Now many are compressed, so a good first step is to change the extension to .zip and try WinRar (or look for a header if you are not lazy).
I assume that with compressed code you can use the same strategy. Try to assume it's using a well known compression algorithm, and crossing your fingers.
Comments
But what if the CPU assumes the instruction stream is compressed?
In the slide 9, they show the frequency of each 16-bit value. In a compressed code, the frequency of each value should be almost equal.
10 or 20 years ago, when reverse engineering any unknown file it was a good to assume it was no compressed and you could get some insight looking at the hex editor and hopping the best. Now many are compressed, so a good first step is to change the extension to .zip and try WinRar (or look for a header if you are not lazy).
I assume that with compressed code you can use the same strategy. Try to assume it's using a well known compression algorithm, and crossing your fingers.
7zip, unar, innoextract...
And, of course, upx.