OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Monday, December 1 2008 11:20.44 CST

Printer Friendly ...

more Anti-Unpacking Tricks

Author: PeterFerrie

# Views: 2931

Today, Virus Bulletin (www.virusbtn.com) has started to publish my follow-up paper. Next month begins the series of all new, never-seen-before tricks. Everyone should subscribe to VB, so they don't have to wait for a month each time to get it free from my site. :-)

Blog Comments

bw	Posted: Tuesday, December 2 2008 08:15.42 CST
did you find them or just rip them from new malware :) ?

PeterFerrie	Posted: Tuesday, December 2 2008 11:49.02 CST
The CARO paper and the one in Virus Bulletin this month describe techniques from malware. From next month, the techniques are all my research, which no-one has ever used before.

NeOXQuiCk	Posted: Tuesday, December 2 2008 12:59.22 CST
hmm Single user - 12 month * For single users only * 12 monthly issues of Virus Bulletin * Full access to all of Virus Bulletin's online content * One discounted rate conference registration for the VB conference Price: 175.00 USD hmm too much for me i will w8 that you rlz it for free :P

zarulshahrin	Posted: Tuesday, December 2 2008 21:37.50 CST
Got them! Good stuff. Anyway, is it going to be like 10 anti-unpacking tricks per month?

PeterFerrie	Posted: Wednesday, December 3 2008 13:26.46 CST
I don't know yet how it will be split. It's 32 pages long, and contains lots of text as well as code, so some parts will have more tricks than others.

vodkastolichnaya	Posted: Friday, December 5 2008 18:04.17 CST
re: From next month, the techniques are all my research, which no-one has ever used before. I wonder how relesing the paper such as this differentiates from relesing new virus zin? vodkastolichnaya

PeterFerrie	Posted: Sunday, December 7 2008 15:00.31 CST
Because they're not viruses. I'm releasing the techniques to take away the advantage that the bad guys have. If they found the techniques first, then they could use them before we even knew that they existed. Now, no-one has the advantage. Of course, if I could have released to only good guys, I would have done that, but I don't know who they are.

PeterFerrie	Posted: Thursday, January 1 2009 14:30.12 CST
First part of the paper is now freely available from my site: http://pferrie.tripod.com

NeOXQuiCk	Posted: Thursday, January 1 2009 15:24.20 CST
thx i was w8 for it for long time :P i am w8 for second paper now ;)

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit