9

Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research. This comparison will only include the protectors I personally have a licence for: VMProtect and Themida. I do not have a licence to Enigma, so I cannot tell about its protection features. I will also not be ...


8

This is a topic that has a ton of depth depending on how crazy you want to go but I'll try to break it down into chunks as much as possible and you can look at each one as much as you want. I'll mention the theory behind the steps and some details about how to do them mechanically as well. Generally the packer is going to do these things: First, you'll ...


7

NX: IMAGE_OPTIONAL_HEADER.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_NX_COMPAT != 0 ASLR: IMAGE_OPTIONAL_HEADER.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE != 0 SAFESEH: (IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].VirtualAddress != 0) && (IMAGE_OPTIONAL_HEADER.DataDirectory[...


4

Also, try Detect It Easy. The project is alive and updated frequently.


4

Short, slightly snarky answer: yes, there must be a way to make a keygen. If there wasn't, the creators of the software themselves wouldn't be able to create keys to sell. Longer answer: If the software vendor wants the encryption to be non-identifiable for people who have reversed the decryption part, they need to use some assymetric key algorithm, where ...


3

It is an old anti-debugging trick to use the TLS callback. The code in the TLS gets executed before the executables entry point and the debugger gains control. This allows the TLS to check for the presence of the debugger and act accordingly. One method to bypass it is using OllyDbg is to pause at "System breakpoint" instead of the default "WinMain" and I ...


2

You could query the page level attributes of the section you're trying to verify. If the attributes contain unexpected values (e.g. PAGE_NOACCESS), chances are that someone messed with your pages (possibly a debugger setting a memory breakpoint).


2

The most likely reason why your breakpoint didn't get hit is because the protected file removed it. Edit: If the breakpoint was hardware-based, then the protected file can use GetThreadContext(), erase the DR entries, SetThreadContext(). If the breakpoint was page-protection-based, then the protected file can use VirtualProtect().


2

See http://2012.ruxconbreakpoint.com/assets/Uploads/bpx/alex-breakpoint2012.pdf: So the signing level is embedded in the signed image's (file's) certificate. There are no special flags passed to CreateProcess(), but PspCreateProcess() (a kernel function that's executed as a result of CreateProcess()) extracts and validates the signing level from the ...


2

I believe most versions of dalvik and art will reject the dex file and refuse to load it.


1

Both work with virtualization techniques, I recommend vm protect from experience and consider it slightly better in machine protection, buy the latest version, if you know how to try adding some of your own techniques, but I believe that only vm protect is enough to the protection of the executable, good luck.


1

Oook i think i i found an answer but i didn't try it and needs more research, it seems there is a special Windows API function used to change protections on .mrdata called LdrProtectMrdata( bProtect ) source: http://mohamoha.club/2017/12/23/Bypass_CFG_Through_MRDATA/


1

Does the book actually use this as an example? This is not going to work in general. The theory behind the snippet is that the code will be compiled in such a way where all of the functions are situated in the assembly language output in the same order in which they were situated in the C code. That is a broken assumption in general. The compiler is under ...


1

Exceptions in TLSCallbacks are discarded by Windows, but stop further callbacks from being called, and then control is transferred to the main entrypoint. However, the code that you've shown for the TLSCallback looks like garbage, the registers aren't predictable, and I doubt that what you've shown is actually executed. Note that the TLSCallback field not ...


1

TLS callbacks may be executed on attach because the OS creates a new thread pointing to DbgUiBreakin with a software breakpoint to stop the execution of the program, and the new thread causes the TLS callback to be executed.


1

I think it's important to differentiate security-oriented microcontrollers where advanced security measures are implemented on several levels including physical arrangement of the chip and general-purpose controllers, maybe with some basic security features. I'm going to answer mostly about the latter group. When a technical reference manual mentions memory ...


1

In your example, the static import user32!DefWindowProcA is getting forwarded to ntdll!NtdllDefWindowProc_A. You need to double-click on the ntdll!NtdllDefWindowProc_A entry in Import REConstructor and change it to user32!DefWindowProcA.


1

Since you don't want to learn RE, there are some free/opensource and paid tools. For the first you probably should look in the answers here. If you feel like spending money you can find some relatively stronger packers like: VMProtect or themida. Good luck!


1

This is covered in-depth in this blog post: http://waleedassar.blogspot.com/2012/11/defeating-memory-breakpoints.html ... This trick can easily detect memory breakpoints. It relies on the fact that the "ReadProcessMemory" function returns false if you try to read guarded or no-access memory. To use this trick, all you have to do is call the "...


1

You can try to use YARA with appropriates rules. Or, if you're lazy, you can give a try to radare2, since it integrates YARA, and has a shitload of packer-related rules. You could also grab the rule files here.


1

If this is for Linux then take a look at http://linux.die.net/man/2/arch_prctl, specifically at the ARCH_SET_FS option.


1

I've found Protection ID to be fast and comprehensive (last update in late 2013).


1

There is no "best" I've used PEiD in the past which always worked pretty well. http://woodmann.com/BobSoft/Pages/Programs/PEiD


Only top voted, non community-wiki answers of a minimum length are eligible