|
I found the decompression routine, but still don't know why OlluDbg cannot break on write to memory!!!
Protector stub calls VirtualProtectEx after 6th exception (copies first 6 bytes, executes them and jumps in middle of API) to change the access to code setion. Is this the cause of bypassing memory breakpoint (as it's page gaurd)?
It seems that protector clears hardware breakpoints too.
__________________
In memory of UnREal RCE...
|