Questions tagged [protection]
The protection tag has no usage guidance.
23
questions
2
votes
1
answer
312
views
Best way to protect source code of exe that being loaded by Assembly.Load method
I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
CommunityBot
- 1
2
votes
0
answers
211
views
Anti-Reversing: Unable to patch memory/set breakpoints of process with x64, unusual memory segment
I'm working on a sample that contains packing and anti-analysis measures.
Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried ...
- 103
1
vote
0
answers
54
views
Is this executable packed, encrypted or what?
I have an executable that I'd like to patch, but I'm very new to RE. I some have assembly knowledge of x86 as first learned language last year, but not of this one: PowerPC (in this case is PPC32), ...
- 166
1
vote
1
answer
1k
views
Latest VMProtect vs Latest Themida [closed]
I am working on an app to archive some important files in a compressed-encrypted format,
What is the best for me to use (Virtualization) VMProtector or Themida ?
Thanks in advance
- 356
1
vote
0
answers
54
views
How to choose a .NET software protector which will have a small impact on run-time performance speed? [closed]
I am writing a .NET software which is doing calculations and drawing in real-time i.e when the user is moving the mouse. I want to protect this software from being reverse engineered and restrict its ...
- 111
1
vote
1
answer
645
views
VirtualProtect failed to revert protections on mrdata section of ntdll, why?
i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
CommunityBot
- 1
0
votes
2
answers
721
views
Basic tampering protection
I'm trying to create a basic program that has memory tampering protection, however it always says it's correct, even if I nop the whole license check function in Ollydbg or change and rebuild the code....
- 8,499
4
votes
3
answers
7k
views
Exe protection by TLS callback, trying to understand the behaviour
I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
- 4,596
4
votes
1
answer
14k
views
How do Enigma, Themida and VMProtect compare to each other?
I'll be releasing a piece of software soon and I'm looking for good protectors. The three that came to my attention were: Enigma, Themida and VMProtect. I searched a lot online but I couldn't find ...
- 216
0
votes
1
answer
154
views
Can JTAG and memory protections be glitched over? (regarding silicon construction of a micro)
Glitch method: irrelevant for topic of conversation, assume clock injection, voltage glitch, EMFI, "lasers", whatever you like.
Device: For example modern ARM or PPC, or MIPS micros. Assuming you can ...
- 619
1
vote
0
answers
323
views
NETGuard vs ILProtector vs AppFuscator [closed]
I have some applications with written in VB.NET. I want to protect them for selling them. I want to use a paid protection. What are the order of those protectors from easier to harder ? How hard is ...
- 111
4
votes
2
answers
964
views
Dalvik dex file version 036
I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem.
But ...
- 103
2
votes
1
answer
2k
views
Anti reverse engineering tools that are easy to set up
I will be distributing a c++ application, and I was wondering if there was any tools available to add an extra layer of security against reverse engineering. I'm looking for a quick fix because I don'...
-1
votes
1
answer
243
views
Can a keygen be created for this protection algorithm? [closed]
I reverse engineered a program protection algorithm and got the result in this source file I wrote, but I would know this type of protection.
Please tell me what is the type of this protection ? And ...
- 565
1
vote
1
answer
6k
views
What it takes to write a simple PE file packer from scratch?
I was wondering to ask here what it takes to write a tiny simple packer for PE files?
I know how a PE file looks like but not in accurate details (if necessary I'll learn as much as it takes) and I ...
- 1,022
1
vote
1
answer
616
views
ImpRec invalid NtdllDefWindowProc_A seem valid
I have a problem that NtdllDefWindowProc_A function from ntdll is
inside user32 thunk.
Following @Jason Geffner answer in ImpRec invalid thunks seem valid I tried to change it to NtdllDefWindowProc_A ...
CommunityBot
- 1
1
vote
1
answer
375
views
How the signature level set to the process in Windows 8?
From this blog article:
Windows PKI Internals (Signing Levels, Scenarios, Root Keys, EKUs & Runtime Signers).
Windows 8 instituted the Signing Level, also sometimes referred to as the ...
- 20.6k
0
votes
1
answer
3k
views
how use pefile to check for NX, ASLR, SAFESEH and CFG (Control Flow Guard) flag [closed]
i use pefile library for help me in vulnerability research,malware analysis and exploit development and try to write script help me to know which protections binary use
i know mona.py from corelan ...
- 134
1
vote
3
answers
559
views
Finding memory breakpoints from debugged executable
Is it possible to find Memory Breakpoints from within the debugged executable? (as an anti debugging technique?). And no, i do not mean Hardware Breakpoints from the Dr0 - Dr7 registers NOR INT3 \ ...
CommunityBot
- 1
1
vote
0
answers
122
views
Packers that partially decrypts contents on-the-fly
I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a ...
CommunityBot
- 1
5
votes
1
answer
4k
views
Why was my memory breakpoint not triggered in OllyDbg?
I am currently battling this protection on an 32-bit executable.
At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
CommunityBot
- 1
1
vote
1
answer
303
views
How to reserve certain amount of memory and using segment register to access?
So basically I am trying to re-implement a memory protection technique, with the description like this:
A 256M segment is reserved for application code and
A 512M segment is reserved for some ...
- 366
0
votes
4
answers
229
views
What program can I use to detect protections used on a program and its libraries?
What are some good programs that can detect which protection software has been used on or in other programs and their libraries?
- 467