Questions tagged [protection]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
0 answers
119 views

Anti-Reversing: Unable to patch memory/set breakpoints of process with x64, unusual memory segment

I'm working on a sample that contains packing and anti-analysis measures. Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried ...
user avatar
1 vote
1 answer
241 views

Best way to protect source code of exe that being loaded by Assembly.Load method

I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
user avatar
1 vote
0 answers
46 views

Is this executable packed, encrypted or what?

I have an executable that I'd like to patch, but I'm very new to RE. I some have assembly knowledge of x86 as first learned language last year, but not of this one: PowerPC (in this case is PPC32), ...
user avatar
  • 156
1 vote
1 answer
1k views

Latest VMProtect vs Latest Themida [closed]

I am working on an app to archive some important files in a compressed-encrypted format, What is the best for me to use (Virtualization) VMProtector or Themida ? Thanks in advance
user avatar
1 vote
0 answers
53 views

How to choose a .NET software protector which will have a small impact on run-time performance speed? [closed]

I am writing a .NET software which is doing calculations and drawing in real-time i.e when the user is moving the mouse. I want to protect this software from being reverse engineered and restrict its ...
user avatar
1 vote
1 answer
560 views

VirtualProtect failed to revert protections on mrdata section of ntdll, why?

i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
user avatar
  • 41
0 votes
2 answers
677 views

Basic tampering protection

I'm trying to create a basic program that has memory tampering protection, however it always says it's correct, even if I nop the whole license check function in Ollydbg or change and rebuild the code....
user avatar
  • 219
4 votes
3 answers
6k views

Exe protection by TLS callback, trying to understand the behaviour

I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
user avatar
3 votes
1 answer
13k views

How do Enigma, Themida and VMProtect compare to each other?

I'll be releasing a piece of software soon and I'm looking for good protectors. The three that came to my attention were: Enigma, Themida and VMProtect. I searched a lot online but I couldn't find ...
user avatar
  • 33
0 votes
1 answer
133 views

Can JTAG and memory protections be glitched over? (regarding silicon construction of a micro)

Glitch method: irrelevant for topic of conversation, assume clock injection, voltage glitch, EMFI, "lasers", whatever you like. Device: For example modern ARM or PPC, or MIPS micros. Assuming you can ...
user avatar
1 vote
0 answers
318 views

NETGuard vs ILProtector vs AppFuscator [closed]

I have some applications with written in VB.NET. I want to protect them for selling them. I want to use a paid protection. What are the order of those protectors from easier to harder ? How hard is ...
user avatar
  • 111
4 votes
2 answers
908 views

Dalvik dex file version 036

I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem. But ...
user avatar
-1 votes
1 answer
237 views

Can a keygen be created for this protection algorithm? [closed]

I reverse engineered a program protection algorithm and got the result in this source file I wrote, but I would know this type of protection. Please tell me what is the type of this protection ? And ...
user avatar
1 vote
1 answer
5k views

What it takes to write a simple PE file packer from scratch?

I was wondering to ask here what it takes to write a tiny simple packer for PE files? I know how a PE file looks like but not in accurate details (if necessary I'll learn as much as it takes) and I ...
user avatar
1 vote
1 answer
574 views

ImpRec invalid NtdllDefWindowProc_A seem valid

I have a problem that NtdllDefWindowProc_A function from ntdll is inside user32 thunk. Following @Jason Geffner answer in ImpRec invalid thunks seem valid I tried to change it to NtdllDefWindowProc_A ...
user avatar
2 votes
1 answer
2k views

Anti reverse engineering tools that are easy to set up

I will be distributing a c++ application, and I was wondering if there was any tools available to add an extra layer of security against reverse engineering. I'm looking for a quick fix because I don'...
user avatar
  • 127
1 vote
1 answer
324 views

How the signature level set to the process in Windows 8?

From this blog article: Windows PKI Internals (Signing Levels, Scenarios, Root Keys, EKUs & Runtime Signers). Windows 8 instituted the Signing Level, also sometimes referred to as the ...
user avatar
  • 115
0 votes
1 answer
2k views

how use pefile to check for NX, ASLR, SAFESEH and CFG (Control Flow Guard) flag [closed]

i use pefile library for help me in vulnerability research,malware analysis and exploit development and try to write script help me to know which protections binary use i know mona.py from corelan ...
user avatar
  • 124
1 vote
3 answers
532 views

Finding memory breakpoints from debugged executable

Is it possible to find Memory Breakpoints from within the debugged executable? (as an anti debugging technique?). And no, i do not mean Hardware Breakpoints from the Dr0 - Dr7 registers NOR INT3 \ ...
user avatar
  • 638
1 vote
0 answers
118 views

Packers that partially decrypts contents on-the-fly

I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a ...
user avatar
5 votes
1 answer
3k views

Why was my memory breakpoint not triggered in OllyDbg?

I am currently battling this protection on an 32-bit executable. At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
user avatar
  • 181
1 vote
1 answer
285 views

How to reserve certain amount of memory and using segment register to access?

So basically I am trying to re-implement a memory protection technique, with the description like this: A 256M segment is reserved for application code and A 512M segment is reserved for some ...
user avatar
0 votes
4 answers
226 views

What program can I use to detect protections used on a program and its libraries?

What are some good programs that can detect which protection software has been used on or in other programs and their libraries?