View Single Post
  #3  
Old 11-23-2003, 09:54
xzz
 
Posts: n/a
Post ...

Thanks I will read..
"But I'm really curious about your mentioning on random gen..0-xxx "

I mean there On xprot packer menu you can add thread for security checks.. many pieces e.g 25 or 100 or more if you see a demo xprot packer.
and you can find white pager here
hxxp://www.xprotector.com/files/XprotectorWhitePaper.pdf
there have a schema for thread working still.

"Could you be more precise? Could you direct me to the white paper and what do you mean by "int3/0 Protect"?"

and this From IDT table you can protect it int3/int0 via ring0 driver
for hide softice tricks etc..

if you try run a packed xprotected exe then try to protect int3 / int 0 (i mean try to hide int3/0)
after on packed exe a threads crashing
because all there threads controlling all time idt etc..
then he cant read idt some place and a crash come..
after all other threads and main control threads waiting it
now you have crashed all protect system (maybe not crash but status to wait)

you maybe not see this because you must a system debugger
like vc++ (just in time debugging check on menu)

and about int3 hide tricks crash not works on all packed exe
if not works my still i try on first my packed exe
file and its all time crashing with my still
after its crashed i run again another packed exe (cant crash)
then it also avaible to crashed
then i do my way..
sorry my english realy bad..



Reply With Quote