News:

MASM32 SDK Description, downloads and other helpful links
MASM32.com New Forum Link
masmforum WebSite

Set Entry Point

Started by Farabi, February 01, 2009, 04:10:16 AM

Previous topic - Next topic

sinsi

QuoteSecureEngineĀ® defeats all current cracking tools that can be used against protected applications and it will make sure that your protected applications are only run in safe environments.
Yeah, right. Just look at securom/starforce for games - sometimes a crack is posted before the game is released (well, so I've been told...)
Remember debug scripts? They're a bit more sophisticated nowadays - just ask IDA.

(Off topic, but I download a few 'trainers' now and then and 'IDA' them - lots use the masm32 package heh heh)
Light travels faster than sound, that's why some people seem bright until you hear them.

BlackVortex

Every thread that starts with a simple UPX question ends up to extreme solutions like winlicense and virtualization.

Also, masm is perfect for trainersĀ  Ā  :toothy

And PECompact is an excellent compressor choice. UPX is good, but discontinued.

Farabi

So if a software are packed, there must be a routine for unpacking it first am I right?
Those who had universe knowledges can control the world by a micro processor.
http://www.wix.com/farabio/firstpage

"Etos siperi elegi"

BlackVortex

Quote from: Farabi on February 07, 2009, 04:46:30 AM
So if a software are packed, there must be a routine for unpacking it first am I right?
Yes, the unpacker code gets executed first, it unpacks the sections of the executable, loads the dlls, creates the import table etc etc.

Then it jumps to the original entry point of the packed program. Pack one of your programs with UPX and step through it in a debugger for a live example.

dedndave

if it can be packed, it can be unpacked
it all depends on how much time you want to put into it

PBrennick

#20
When you are told that the Start is outside of the code or program what you are being told is that the stub contains the entrypoint and also contains the pointer to the real starting point; it merely looks like it is because the stub needs to run to decompress the code. Because of this, the Start point does not look valid until the code decompresses. OllyDebug has no way of knowing this.

I probably am not stating this very well but I am sure you can get the point I am trying to make.

Also, about hiding resources as someone mentioned here; most resources can be created in the code section. My version of Sudoku is a good example of this - 81 buttons - nothing about them in the RC file. Take a look at it. Also, Hutch has some excellent stuff about this in his SDK.

Paul
The GeneSys Project is available from:
The Repository or My crappy website

ragdogz

Quote from: busclock on February 02, 2009, 11:43:57 AMdo the zero-fill in the beginning of the program using hex editor, then UPX won't recoqnize it anymore.. :green

Hi, now i realized that i break this following UPX License by doing such an action..

Quote- We grant you special permission to freely use and distribute all UPX
    compressed programs. But any modification of the UPX stub (such as,
    but not limited to, removing our copyright string or making your
    program non-decompressible) will immediately revoke your right to
    use and distribute a UPX compressed program.

  - UPX is not a software protection tool; by requiring that you use
    the unmodified UPX version for your proprietary programs we
    make sure that any user can decompress your program. This protects
    both you and your users as nobody can hide malicious code -
    any program that cannot be decompressed is highly suspicious
    by definition.

can someone give me some real free executable compressor?
or maybe is there a way just to protect strings in my program?
thx..

Vortex

Have a look at here for some exe compressors.