View Single Post
  (#3 (permalink)) Old
mdk
Member
 


32-Bit Member

 
Posts: 35
Join Date: Jun 2009
Last Online: 03-08-2010 08:24 PM
Reputation: mdk is on a distinguished road
User is Offline
germany
   
07-07-2009, 04:58 PM

Absolute protection is impossible. If your trainer works, there is always a way to find out how. It may just get more complicated with added security.

Using a protector for executable files (like Themida that was mentioned) is a easy to accomplish a first step. Next you can add custom security checks, like looking for special window-names (e.g. OllyDbg, TSearch) or trying to detect hooks placed on Read- and WriteProcessMemory.

If you found something suspicious don't just exit the trainer. Be more subtle, write to wrong addresses or stop reacting on hotkeys. If you want to be more aggresive try to terminate these programs.

You can protect your trainer by writing watermarks to your target process. Find an unused area and write special values to it. If your work is stolen, chances are these fake values are also written by the thief. Just check by using his trainer and look out for the watermark in memory.
  
Reply With Quote