Flag: Tornado!
Hurricane!
|
|
 No blog entries found for specified user.
Topic created on: by  .
|
because messing with global flags can cause mess
|
|
but i have to set the globalflag to 0, otherwise execryptor apps dont run. What mess can happen when i do that?
|
nice articles, however they dont say that changing NtGlobalFlag is evil....
Why should is it dangerous to do it?
|
|
NtGlabalFlag is a field in PEB, and since PEB isn't documented better don't patch it. imagine what happens if PEB will change in the future win-version. however, if it works, everything is fine, don't worry.
|
any application that is debugged uses DebugHeap Enabled by default and i think (not sure never used it much to check it out fully) ollyadvanced turns off the DebugHeap to null (post initialization of LdrpInitialize() which means only
those applications that explicitly check ntglobalflag will be fooled and those application that check the heap for heap length and debugheap tags and its signatures and the ForceFlags Siggnature of debugHeap will not be fooled
you can read a few things about the process in this thread
http://forum.exetools.com/showthread.php?t=7363 especially the part where the discussion is about HideDebugger Plugin versus NtglobalFlag patching is talked about (some functions explicitly need Debug Functionalities to work properly Like Dbgprint()
you can take a look at the sources of the plugin that used this mechanism at this link
http://www.reversing.be/article.php?story=20050603193932184
as long as you know what you are doing patching isnt evil :)
|
Note: Registration is required to post to the forums.
|
|
|
|
There are 31,328 total registered users.
|
|
![[+] expand](/imagery/files/soysauce_blueprint.gif){kind=link}