SD Protector Pro

[ricnar456]

I don't try with regmon or filemon, but you try with a renamed regmon with other name of the file and other name of the window? similar case for filemon try renaming the file and renaming the class and title of the main window, i think is possible avoid detection.(is only a suggestion i don't try)

Ricardo Narvaja

Sd Protector Pro is a nice packer.

It uses some nice trick to avoid dumping and also avoid the usage of ImpRec.

hints: look at pages access rights

Rebuilding the imports is quite easy, you just got to write a litle plugin for imprec, that is able to parse the "obfuscation", or rather, the garbage, and
locate the code that calculate the good api address.

Then there are some threads (2) that detects tools running.

With Soft ICE you can easily disable them: Hint: bpint is your friend.

I won't give too much info for now, but its a lot easier with Soft ICE than it is
with Olly

Cheers.