EXETOOLS FORUM  

Go Back   EXETOOLS FORUM > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 04-12-2017, 23:51
elephant elephant is offline
Friend
 
Join Date: Feb 2005
Posts: 74
Rept. Given: 2
Rept. Rcvd 25 Times in 12 Posts
Thanks Given: 97
Thanks Rcvd at 88 Times in 27 Posts
elephant Reputation: 25
Post How to develop an unpacker - The StarForce case

Very cool presentation, published on the 7th April 2017 by Eloi Vanderbeken at the Sthack security conference in Bordeaux, about unpacking StarForce:

http://www.synacktiv.ninja/ressource..._synacktiv.pdf

This unpacker is based on DLL injection and take care of recovering the OEP, API redirection, stolen bytes, debugger detection and hide from debugger routines.
Reply With Quote
The Following User Says Thank You to elephant For This Useful Post:
besoeso (04-13-2017)
  #2  
Old 04-13-2017, 01:18
evlncrn8 evlncrn8 is offline
VIP
 
Join Date: Sep 2005
Posts: 139
Rept. Given: 26
Rept. Rcvd 53 Times in 23 Posts
Thanks Given: 20
Thanks Rcvd at 29 Times in 17 Posts
evlncrn8 Reputation: 53
was more starforce proactive (which is weak as hell) as opposed to the real (disk) one so a bit 'meh'.. and in all his 'research' how come he didnt notice the flaw in starforces api 'rewrite' code where if you detoured all the exported functions to ff 25 xx xx xx xx ones it copied them verbatim, thus making the api resolution very very simple... and this information was known in 2003 or so when i found it...
Reply With Quote
The Following User Says Thank You to evlncrn8 For This Useful Post:
TechLord (04-13-2017)
  #3  
Old 04-13-2017, 09:58
mr.exodia's Avatar
mr.exodia mr.exodia is offline
Super Moderator
 
Join Date: Nov 2011
Posts: 820
Rept. Given: 475
Rept. Rcvd 1,154 Times in 308 Posts
Thanks Given: 73
Thanks Rcvd at 428 Times in 168 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
not everybody has friends in the scene
__________________
x64dbg: http://x64dbg.com
My Blog: http://mrexodia.cf
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How can I develop Hook program? tumtum General Discussion 1 02-09-2004 03:08


All times are GMT +8. The time now is 01:29.


ICP05004977
vBulletin Security provided by vBSecurity v2.2.0 (Lite) - vBulletin Mods & Addons Copyright © 2017 DragonByte Technologies Ltd.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX