Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #3  
Old 11-23-2003, 09:54
xzz
 
Posts: n/a
Post ...

Thanks I will read..
"But I'm really curious about your mentioning on random gen..0-xxx "

I mean there On xprot packer menu you can add thread for security checks.. many pieces e.g 25 or 100 or more if you see a demo xprot packer.
and you can find white pager here
hxxp://www.xprotector.com/files/XprotectorWhitePaper.pdf
there have a schema for thread working still.

"Could you be more precise? Could you direct me to the white paper and what do you mean by "int3/0 Protect"?"

and this From IDT table you can protect it int3/int0 via ring0 driver
for hide softice tricks etc..

if you try run a packed xprotected exe then try to protect int3 / int 0 (i mean try to hide int3/0)
after on packed exe a threads crashing
because all there threads controlling all time idt etc..
then he cant read idt some place and a crash come..
after all other threads and main control threads waiting it
now you have crashed all protect system (maybe not crash but status to wait)

you maybe not see this because you must a system debugger
like vc++ (just in time debugging check on menu)

and about int3 hide tricks crash not works on all packed exe
if not works my still i try on first my packed exe
file and its all time crashing with my still
after its crashed i run again another packed exe (cant crash)
then it also avaible to crashed
then i do my way..
sorry my english realy bad..



Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
TIB/PEB Info for X64 mesagio x64 OS 2 08-13-2011 17:39
looking for adware info and homepage hijacker info chad1111 General Discussion 7 01-10-2005 21:02
Need some info. hobgoblin General Discussion 3 06-29-2004 05:14


All times are GMT +8. The time now is 11:39.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )