View Single Post
  #5  
Old 08-30-2003, 21:41
dynio
 
Posts: n/a
Well, I'm too lazy to write assembly code here (If You really need it I can do it at next week) but there are a lot of examples. Let's show the latest: Xtreme Protector maps the memory at the device driver level so traditional dumpers won't even touch the target. Also it erases few first bytes of OEP and makes a hell using multiple threads communication to decrypt and prevent debugging. Although automatic skipper/decrypter/unpacker/rebuilder sounds like a mistake, it's not so hard to dump executable and finish it manually (if You have free time). If someone would pay me (I'm assuming the situation only) for writing XProtector unpacker I would say: not less than 1.500$.
In their papers they claim: "it's virtually impossible to trace the program under any kind of debugger" - as usual, THAT'S A LIE.
Ooops... I'm probably missing the point Anyway, if someone is interested I recommend: "Inside Windows 2000 - 3rd Edition" (Redmond (WA) Microsoft Press) - a great book from SysInternals.

Regards.
Reply With Quote