Topic created on: August 15, 2008 07:19 CDT by noglorp .

Fairly simplistic:
Call ConvertThreadToFiber prior OEP, and then within the packed code plant calls to CreateFiber (could also be pre-OEP) and SwitchToFiber. If the process is dumped at OEP, the call to SwitchToFiber will cause an access violation.

What makes this a little sexier is that SwitchToFiber contains no calls itself and could be inlined, making it hard to spot/easy to obfuscate. Along with calling CreateFiber in unpacking stub this could require a sharp eye to spot.

Sample code for convenience:
#include <stdlib.h>
#include <stdio.h>

#define WIN32_LEAN_AND_MEAN
#include <windows.h>

void __stdcall Test()
{
printf("Inside fiber");
}

void main2()
{
void *f = CreateFiber(0,Test,NULL);
printf("Pre fiber - ");
SwitchToFiber(f);
}
int main()
{
ConvertThreadToFiber(NULL);
main2();

return 0;
}