|
to peleon
with all my respects, in armadillo with copymem2, if you wait till program is full decrypted in memory you wait eternally, never is full decypted in memory, the father process copy only 1000 bytes in the child process, execute this 1000 bytes and erase this 1000 bytes, copy other 1000 bytes execute and erase, never the target is full decrypted, the solucion is force the farher decrypt all and next beggining to execute, but is not a work for my sister, jeje is a hard work, and next you can fight with the nanomites, when you have the full program dumped, not run by nanomites (INT3), the jmps of the original program was replaced by INT3, and you can determine, what jump are (conditional or jmp) if jump or not jump ,and where jump, if you put your sister to make this work, you are a bad brother, jeje.
Ricardo
|