Quote:
Originally Posted by Smaehtin
Uhm, they're already detecting changes to the Conquer.exe file. That's easy as hell to check too, make a checksum of the original .exe file and compare it against your modified .exe :confused::confused::confused:
|
PHP Code:
00400278 /. 2E 64 61 ASCII ".data",0,0,0 ; Name[8] = ".data"
00400280 |. C4AE0300 DD 0003AEC4 ; VirtualSize = 241348.
00400284 |. 00105C00 DD 005C1000 ; VirtualAddress = 5C1000
00400288 |. 00300100 DD 00013000 ; SizeOfRawData = 77824.
0040028C |. 00F65B00 DD 005BF600 ; PointerToRawData = 5BF600
00400290 |. 00000000 DD 00000000 ; PointerToRelocations = 0
00400294 |. 00000000 DD 00000000 ; PointerToLineNumbers = 0
00400298 |. 0000 DW 0 ; NumberOfRelocations = 0
0040029A |. 0000 DW 0 ; NumberOfLineNumbers = 0
0040029C \. 400000C0 DD C0000040 ; Characteristics = INITIALIZED_DATA|READ|WRITE
00400318 /. 2E 64 61 ASCII ".data1",0,0 ; Name[8] = ".data1"
00400320 |. 00500000 DD 00005000 ; VirtualSize = 20480.
00400324 |. 00106500 DD 00651000 ; VirtualAddress = 651000
00400328 |. 00500000 DD 00005000 ; SizeOfRawData = 20480.
0040032C |. 00566200 DD 00625600 ; PointerToRawData = 625600
00400330 |. 00000000 DD 00000000 ; PointerToRelocations = 0
00400334 |. 00000000 DD 00000000 ; PointerToLineNumbers = 0
00400338 |. 0000 DW 0 ; NumberOfRelocations = 0
0040033A |. 0000 DW 0 ; NumberOfLineNumbers = 0
0040033C \. 200000E0 DD E0000020 ; Characteristics = CODE|EXECUTE|READ|WRITE
They are scanning the .text section for any modifications. hence: Hardware breakpoint at 00401000 and login.
.data is the original section and my code goes into .data1 which is a new section that i have created.
As for "That's easy as hell to check" its also as easy to fool the process into scanning a section that I created which will be a copy of the original section that's being scanned which i have already done. Not because a copy is needed at the time but just in case.