EXETOOLS FORUM  

Go Back   EXETOOLS FORUM > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 04-12-2017, 23:51
elephant elephant is offline
Friend
 
Join Date: Feb 2005
Posts: 74
Rept. Given: 2
Rept. Rcvd 25 Times in 12 Posts
Thanks Given: 97
Thanks Rcvd at 89 Times in 27 Posts
elephant Reputation: 25
Post How to develop an unpacker - The StarForce case

Very cool presentation, published on the 7th April 2017 by Eloi Vanderbeken at the Sthack security conference in Bordeaux, about unpacking StarForce:

http://www.synacktiv.ninja/ressource..._synacktiv.pdf

This unpacker is based on DLL injection and take care of recovering the OEP, API redirection, stolen bytes, debugger detection and hide from debugger routines.
Reply With Quote
The Following User Says Thank You to elephant For This Useful Post:
besoeso (04-13-2017)
  #2  
Old 04-13-2017, 01:18
evlncrn8 evlncrn8 is offline
VIP
 
Join Date: Sep 2005
Posts: 141
Rept. Given: 26
Rept. Rcvd 53 Times in 23 Posts
Thanks Given: 20
Thanks Rcvd at 30 Times in 18 Posts
evlncrn8 Reputation: 53
was more starforce proactive (which is weak as hell) as opposed to the real (disk) one so a bit 'meh'.. and in all his 'research' how come he didnt notice the flaw in starforces api 'rewrite' code where if you detoured all the exported functions to ff 25 xx xx xx xx ones it copied them verbatim, thus making the api resolution very very simple... and this information was known in 2003 or so when i found it...
Reply With Quote
The Following User Says Thank You to evlncrn8 For This Useful Post:
TechLord (04-13-2017)
  #3  
Old 04-13-2017, 09:58
mr.exodia's Avatar
mr.exodia mr.exodia is offline
Super Moderator
 
Join Date: Nov 2011
Posts: 822
Rept. Given: 476
Rept. Rcvd 1,154 Times in 308 Posts
Thanks Given: 73
Thanks Rcvd at 435 Times in 170 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
not everybody has friends in the scene
__________________
x64dbg: http://x64dbg.com
My Blog: http://mrexodia.cf
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How can I develop Hook program? tumtum General Discussion 1 02-09-2004 03:08


All times are GMT +8. The time now is 12:55.


ICP05004977
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX