View Single Post
  (#8 (permalink)) Old
PoZHx
Crew
 
PoZHx's Avatar
 



128-Bit Member

 
Posts: 354
Join Date: Mar 2009
Location: {LocalHost}
Last Online: Yesterday 11:48 PM
Reputation: PoZHx is on a distinguished road
User is Offline
uk
   
09-11-2009, 06:18 PM

Quote Originally Posted by SunBeam View Post
Your best protection would be your own personal library with to-be-written data and mutation of code. Hook game functions like so:

game.exe+0xoffset:
jmp [dll_function]

dll_function:
{mutated_code_here} // Themida or VMProtect
ret

Notice I said mutated and not virtualized. No need for crappy VMs..
Hmm i dont quite understand that =/
Well currently im using:
  • Anti-Breakpoints (int3 and hardware)
  • Check Debug Flags using NtQueryInformationProcess
  • Checking Debugger using int2 (by setting up SEH? - not 100% sure on how that works)
  • Few Anti-Debugging API's e.g. CheckRemoteDebuggerPresent() etc
Is it worth taking a look into your suggestion?
  
Reply With Quote