11 votes
Accepted

How do Enigma, Themida and VMProtect compare to each other?

Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research. This comparison will only include the protectors ...
3dsboy08's user avatar
  • 226
9 votes

What it takes to write a simple PE file packer from scratch?

This is a topic that has a ton of depth depending on how crazy you want to go but I'll try to break it down into chunks as much as possible and you can look at each one as much as you want. I'll ...
Fewmitz's user avatar
  • 1,022
4 votes
Accepted

Can a keygen be created for this protection algorithm?

Short, slightly snarky answer: yes, there must be a way to make a keygen. If there wasn't, the creators of the software themselves wouldn't be able to create keys to sell. Longer answer: If the ...
Guntram Blohm's user avatar
4 votes

Exe protection by TLS callback, trying to understand the behaviour

It is an old anti-debugging trick to use the TLS callback. The code in the TLS gets executed before the executables entry point and the debugger gains control. This allows the TLS to check for the ...
Crudd's user avatar
  • 41
2 votes

Dalvik dex file version 036

I believe most versions of dalvik and art will reject the dex file and refuse to load it.
JesusFreke's user avatar
2 votes

Exe protection by TLS callback, trying to understand the behaviour

Exceptions in TLSCallbacks are discarded by Windows, but stop further callbacks from being called, and then control is transferred to the main entrypoint. However, the code that you've shown for the ...
peter ferrie's user avatar
  • 4,709
1 vote

Protection of the source code of an ML model

If I understand your requirements correctly what you need is pyarmor or something similar such as oxyry or pyobfuscate. These packages are able to obfuscate the code, which makes reversing harder. ...
w s's user avatar
  • 8,468
1 vote

Latest VMProtect vs Latest Themida

Both work with virtualization techniques, I recommend vm protect from experience and consider it slightly better in machine protection, buy the latest version, if you know how to try adding some of ...
Happy's user avatar
  • 366
1 vote

VirtualProtect failed to revert protections on mrdata section of ntdll, why?

Oook i think i i found an answer but i didn't try it and needs more research, it seems there is a special Windows API function used to change protections on .mrdata called LdrProtectMrdata( bProtect ) ...
n1h1l's user avatar
  • 41
1 vote

Basic tampering protection

Does the book actually use this as an example? This is not going to work in general. The theory behind the snippet is that the code will be compiled in such a way where all of the functions are ...
Rolf Rolles's user avatar
  • 9,198
1 vote

Exe protection by TLS callback, trying to understand the behaviour

TLS callbacks may be executed on attach because the OS creates a new thread pointing to DbgUiBreakin with a software breakpoint to stop the execution of the program, and the new thread causes the TLS ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Can JTAG and memory protections be glitched over? (regarding silicon construction of a micro)

I think it's important to differentiate security-oriented microcontrollers where advanced security measures are implemented on several levels including physical arrangement of the chip and general-...
Vladislav Ivanov's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible