more Anti-Unpacking Tricks
Peter Ferrie (PeterFerrie) <peter_ferriehotmailcom> Monday, December 1 2008 11:20.44 CST


Today, Virus Bulletin (www.virusbtn.com) has started to publish my follow-up paper.  Next month begins the series of all new, never-seen-before tricks.  Everyone should subscribe to VB, so they don't have to wait for a month each time to get it free from my site. :-)


Comments
bw Posted: Tuesday, December 2 2008 08:15.42 CST
did you find them or just rip them from new malware :) ?

PeterFerrie Posted: Tuesday, December 2 2008 11:49.02 CST
The CARO paper and the one in Virus Bulletin this month describe techniques from malware.  From next month, the techniques are all my research, which no-one has ever used before.

NeOXQuiCk Posted: Tuesday, December 2 2008 12:59.22 CST
hmm Single user - 12 month

    * For single users only
    * 12 monthly issues of Virus Bulletin
    * Full access to all of Virus Bulletin's online content
    * One discounted rate conference registration for the VB conference

Price: 175.00 USD

hmm too much for me i will w8 that you rlz it for free :P

zarulshahrin Posted: Tuesday, December 2 2008 21:37.50 CST
Got them! Good stuff. Anyway, is it going to be like 10 anti-unpacking tricks per month?

PeterFerrie Posted: Wednesday, December 3 2008 13:26.46 CST
I don't know yet how it will be split.  It's 32 pages long, and contains lots of text as well as code, so some parts will have more tricks than others.

vodkastolichnaya Posted: Friday, December 5 2008 18:04.17 CST
re:  From next month, the techniques are all my research, which no-one has ever used before.

I wonder how relesing the paper such as this differentiates from relesing new virus zin?

vodkastolichnaya

PeterFerrie Posted: Sunday, December 7 2008 15:00.31 CST
Because they're not viruses.
I'm releasing the techniques to take away the advantage that the bad guys have.  If they found the techniques first, then they could use them before we even knew that they existed.  Now, no-one has the advantage.  Of course, if I could have released to only good guys, I would have done that, but I don't know who they are.

PeterFerrie Posted: Thursday, January 1 2009 14:30.12 CST
First part of the paper is now freely available from my site:
http://pferrie.tripod.com

NeOXQuiCk Posted: Thursday, January 1 2009 15:24.20 CST
thx i was w8 for it for long time :P i am w8 for second paper now ;)