I am starring at the following exe file, see main page here. It seems pretty clear (using -E entropy option) that the exe contains compressed section. For some reason binwalk is not capable of finding the start of those sections.Here is what I have:$ binwalk -v -B PmsDView.exe Scan Time:     2016-09-22 14:42:04Target File:   /tmp/PmsDView.exeMD5 Checksum:  911d92675f559a40400f7ca2b69c8544Signatures:    344DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------0             0x0             Microsoft executable, portable (PE)2015          0x7DF           Copyright string: Copyright 1995-2005 Mark Adler However it seems like they are using gzip:$ hexdump -C PmsDView.exe000007a0  30 00 30 00 31 00 35 00  00 00 00 00 4c 64 72 47  |0.0.1.5.....LdrG|000007b0  65 74 50 72 6f 63 65 64  75 72 65 41 64 64 72 65  |etProcedureAddre|000007c0  73 73 00 00 6e 74 64 6c  6c 00 00 00 00 00 00 00  |ss..ntdll.......|000007d0  20 69 6e 66 6c 61 74 65  20 31 2e 32 2e 33 20 43  | inflate 1.2.3 C|000007e0  6f 70 79 72 69 67 68 74  20 31 39 39 35 2d 32 30  |opyright 1995-20|000007f0  30 35 20 4d 61 72 6b 20  41 64 6c 65 72 20 00 00  |05 Mark Adler ..|Am I missing something ? Or did they mask the gzip signature ?
binwalk cannot find gzip sections
binary analysis;decompress
Binwalk did not find the zlib blob because it is also encrypted. It uses the following code to decrypt the compressed data. The decryption uses a table stored in the stack, which is filled with generated values before the loop.Thus, you have to reverse the decryption code or save the decompressed data from the memory.