Exetools  

Go Back   Exetools > General > Source Code

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 10-24-2014, 13:46
Conquest Conquest is offline
Friend
 
Join Date: Jan 2013
Location: 0x484F4D45
Posts: 125
Rept. Given: 46
Rept. Rcvd 29 Times in 17 Posts
Thanks Given: 33
Thanks Rcvd at 60 Times in 29 Posts
Conquest Reputation: 29
Quote:
Originally Posted by Newbie_Cracker View Post
Yeah, It is very useful especially for patching child process created by father process; such as Armadillo, SDProtect, etc.

I always use hook method when loaders like dUP2 fails to patch on time.

So if the VMProtect does not check for API hooking, this method is the best.
Problem is ,like themida, vmp uses emulated api as well . so normally its hard to predict which api is "universally free" from api emulation and thus hooking doesnt work in all cases
Reply With Quote
  #2  
Old 10-24-2014, 18:11
0x22 0x22 is offline
Family
 
Join Date: Aug 2014
Posts: 66
Rept. Given: 14
Rept. Rcvd 47 Times in 18 Posts
Thanks Given: 12
Thanks Rcvd at 64 Times in 21 Posts
0x22 Reputation: 47
Quote:
Originally Posted by Conquest View Post
Problem is ,like themida, vmp uses emulated api as well . so normally its hard to predict which api is "universally free" from api emulation and thus hooking doesnt work in all cases
This has worked bulletproof on VMProtect, Themida and Safengine for several dozen of loaders for me, never had any problems with using this method tbh.

Last edited by 0x22; 10-24-2014 at 18:17.
Reply With Quote
  #3  
Old 10-24-2014, 23:55
Conquest Conquest is offline
Friend
 
Join Date: Jan 2013
Location: 0x484F4D45
Posts: 125
Rept. Given: 46
Rept. Rcvd 29 Times in 17 Posts
Thanks Given: 33
Thanks Rcvd at 60 Times in 29 Posts
Conquest Reputation: 29
Quote:
Originally Posted by 0x22 View Post
This has worked bulletproof on VMProtect, Themida and Safengine for several dozen of loaders for me, never had any problems with using this method tbh.
i dont see any link between your message and my statement . it doesnt apply to your method at all .
Reply With Quote
  #4  
Old 10-25-2014, 01:34
0x22 0x22 is offline
Family
 
Join Date: Aug 2014
Posts: 66
Rept. Given: 14
Rept. Rcvd 47 Times in 18 Posts
Thanks Given: 12
Thanks Rcvd at 64 Times in 21 Posts
0x22 Reputation: 47
Quote:
Originally Posted by Conquest View Post
i dont see any link between your message and my statement . it doesnt apply to your method at all .
I'm sorry i must've misunderstood, my apologies
Reply With Quote
The Following User Gave Reputation+1 to 0x22 For This Useful Post:
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On


Similar Threads
Thread Thread Starter Forum Replies Last Post
[HELP] How to write a simple Loader in ASM on MSDOS stoney81 General Discussion 5 12-20-2024 15:55
Simple Task [make loader for UPX target]... diablo2oo2 General Discussion 1 12-30-2004 07:03


All times are GMT +8. The time now is 19:22.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )