-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating
Mastering Reverse Engineering
By :
This method does not stop dumping memory to a file. This trick instead prevents the reverser from easily understanding the dumped data. Here are some examples of how this could be applied:
Portions of the PE header have been modified, so that the process dump gives the wrong properties.
Portions of PEB, such as SizeOfImage, have been modified, so that the process dumping tool dumps wrong.
Dumping is very useful for seeing decrypted data. Anti-dumping tricks would re-encrypt the decrypted code or data after use.
To overcome this trick, we can either identify or skip the code that modifies data. For re-encryption, we can also skip the code that re-encrypts, to leave it in a decrypted state.