The last issue of 2009 up 2 maso debugger plug-in that series is over.
Both feature a self-made plug-in plug-in jujera was created.
1) memory on the binary files and after phase modulated code to detect the hooked tamjina
2) xor encryption routines for the discovery to find opkodeureul
Is very simple to use.
DLL: dll or exe to put the name of the module to scan,
Check the Scan All Process the current eotaechidoen process to scan the entire module.
Search Hook detection of the modulated code, XOR, locate the opkodeureul xor Literally.
(xor eax, eax, of course, does not find this stuff)
发表于 2009-3-19 10:03
发表于 2009-3-19 12:14
发表于 2009-3-19 16:19
