Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #8  
Old 05-17-2006, 19:19
adaptor adaptor is offline
Friend
 
Join Date: Jan 2006
Posts: 27
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
adaptor Reputation: 0
Dont' forget about MmGetSystemRoutineAddress routine Of couse if it works only for routines exported by ntoskrnl or HAL.. But in some cases it's enough.

Here is a plan how to make simple native encryptor Very common.
1) Get some user mode PE encryptor\compressor sources (better in asm)
2) Change GetProcAddress to MmGetSystemRoutineAddress
3) Change VirtualAlloc\VirtualFree to ExAllocatePool\ExFreePool
4) Debug

P.S. Classical compression based on possibility of making VirualSize of PE section bigger than PhisicalSize will work only in case Section alignment= 1000, File alignment= 200. Any other combination does'nt work for me.

Anyway compression in drivers it's not a good idea coz memory in pool is very
valuable resource.

Last edited by adaptor; 05-17-2006 at 19:47.
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Encrypt and Decrypt with public key and private key(RSA based) CarrotStickCam Source Code 2 01-16-2023 14:53


All times are GMT +8. The time now is 08:25.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )