Recently I have found the article Using UPX as a Security Packer. Here, UPX is patched, after decompressing, also restores some overwritten bytes. This way, if somebody decompresses the binary with upx -d in order to analyse it, will obtain a nonworking binary.
An other solution to prevent static analysis is to encrypt a part of the code and decrypt it at runtime using mprotect from C.
So actually both methods can be used to encrypt code, the only difference being, that in the first case the elf entry point is modified, and the stub restores the original code, in the second case the execution starts from the original entry point. The latter method seems to be more simple. If I want to protect my binary from disassembling, does the second method has any disadvantage compared to the first one? I think without antidebugging tricks both methods can be reversed the same way, and when decrypting is done memory can be dumped.
