Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [protection]

The tag has no usage guidance.

1
vote
1answer
117 views

VirtualProtect failed to revert protections on mrdata section of ntdll, why?

i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
0
votes
2answers
372 views

Basic tampering protection

I'm trying to create a basic program that has memory tampering protection, however it always says it's correct, even if I nop the whole license check function in Ollydbg or change and rebuild the code....
3
votes
3answers
966 views

Exe protection by TLS callback, trying to understand the behaviour

I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
2
votes
1answer
3k views

How do Enigma, Themida and VMProtect compare to each other?

I'll be releasing a piece of software soon and I'm looking for good protectors. The three that came to my attention were: Enigma, Themida and VMProtect. I searched a lot online but I couldn't find ...
0
votes
1answer
50 views

Can JTAG and memory protections be glitched over? (regarding silicon construction of a micro)

Glitch method: irrelevant for topic of conversation, assume clock injection, voltage glitch, EMFI, "lasers", whatever you like. Device: For example modern ARM or PPC, or MIPS micros. Assuming you can ...
1
vote
0answers
217 views

NETGuard vs ILProtector vs AppFuscator [closed]

I have some applications with written in VB.NET. I want to protect them for selling them. I want to use a paid protection. What are the order of those protectors from easier to harder ? How hard is ...
5
votes
2answers
449 views

Dalvik dex file version 036

I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem. But ...
0
votes
1answer
157 views

Can a keygen be created for this protection algorithm? [closed]

I reverse engineered a program protection algorithm and got the result in this source file I wrote, but I would know this type of protection. Please tell me what is the type of this protection ? And ...
1
vote
1answer
3k views

What it takes to write a simple PE file packer from scratch?

I was wondering to ask here what it takes to write a tiny simple packer for PE files? I know how a PE file looks like but not in accurate details (if necessary I'll learn as much as it takes) and I ...
1
vote
1answer
365 views

ImpRec invalid NtdllDefWindowProc_A seem valid

I have a problem that NtdllDefWindowProc_A function from ntdll is inside user32 thunk. Following @Jason Geffner answer in ImpRec invalid thunks seem valid I tried to change it to NtdllDefWindowProc_A ...
2
votes
1answer
1k views

Anti reverse engineering tools that are easy to set up

I will be distributing a c++ application, and I was wondering if there was any tools available to add an extra layer of security against reverse engineering. I'm looking for a quick fix because I don'...
1
vote
1answer
152 views

How the signature level set to the process in Windows 8?

From this blog article: Windows PKI Internals (Signing Levels, Scenarios, Root Keys, EKUs & Runtime Signers). Windows 8 instituted the Signing Level, also sometimes referred to as the ...
0
votes
1answer
2k views

how use pefile to check for NX, ASLR, SAFESEH and CFG (Control Flow Guard) flag [closed]

i use pefile library for help me in vulnerability research,malware analysis and exploit development and try to write script help me to know which protections binary use i know mona.py from corelan ...
1
vote
3answers
355 views

Finding memory breakpoints from debugged executable

Is it possible to find Memory Breakpoints from within the debugged executable? (as an anti debugging technique?). And no, i do not mean Hardware Breakpoints from the Dr0 - Dr7 registers NOR INT3 \ ...
1
vote
0answers
99 views

Packers that partially decrypts contents on-the-fly

I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a ...
5
votes
1answer
2k views

Why was my memory breakpoint not triggered in OllyDbg?

I am currently battling this protection on an 32-bit executable. At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
1
vote
1answer
216 views

How to reserve certain amount of memory and using segment register to access?

So basically I am trying to re-implement a memory protection technique, with the description like this: A 256M segment is reserved for application code and A 512M segment is reserved for some ...
0
votes
4answers
197 views

What program can I use to detect protections used on a program and its libraries?

What are some good programs that can detect which protection software has been used on or in other programs and their libraries?