Comments on: Unpacking by hooking? http://blog.reversinglabs.com/2010/06/unpacking-by-hooking/ Everything in reverse... Sun, 03 Jul 2011 02:18:33 +0000 hourly 1 http://wordpress.org/?v=3.1.4 By: hooker http://blog.reversinglabs.com/2010/06/unpacking-by-hooking/comment-page-1/#comment-701 hooker Thu, 24 Jun 2010 08:10:32 +0000 http://blog.reversinglabs.com/?p=676#comment-701 sounds like a great approach. regarding to the comments, could you point me to any info on "blind loaders" and the "EBFE method"? sounds like a great approach.

regarding to the comments, could you point me to any info on “blind loaders” and the “EBFE method”?

]]> By: Ghandi http://blog.reversinglabs.com/2010/06/unpacking-by-hooking/comment-page-1/#comment-694 Ghandi Mon, 14 Jun 2010 16:20:24 +0000 http://blog.reversinglabs.com/?p=676#comment-694 Agreed, when trivial anti-debug is involved, a debug loader is ideal. :D HR, Ghandi Agreed, when trivial anti-debug is involved, a debug loader is ideal. :D

HR,
Ghandi

]]> By: admin http://blog.reversinglabs.com/2010/06/unpacking-by-hooking/comment-page-1/#comment-692 admin Mon, 14 Jun 2010 14:22:04 +0000 http://blog.reversinglabs.com/?p=676#comment-692 That is true, however for the proof-of-concept work with UPX debug injector is sufficient. For samples that have complex antidebugging one can use EBFE method to inject the unpacking library. Best regards That is true, however for the proof-of-concept work with UPX debug injector is sufficient. For samples that have complex antidebugging one can use EBFE method to inject the unpacking library.

Best regards

]]> By: Ghandi http://blog.reversinglabs.com/2010/06/unpacking-by-hooking/comment-page-1/#comment-691 Ghandi Mon, 14 Jun 2010 13:56:42 +0000 http://blog.reversinglabs.com/?p=676#comment-691 Nice concept, i've used it for unpacking dlls within a single process before. I must say though, i used a 'blind' loader rather than a debug one, because any 'stealth' gained by injecting the dll is lost by starting the process with a debugger. HR, Ghandi Nice concept, i’ve used it for unpacking dlls within a single process before. I must say though, i used a ‘blind’ loader rather than a debug one, because any ‘stealth’ gained by injecting the dll is lost by starting the process with a debugger.

HR,
Ghandi

]]> By: rage http://blog.reversinglabs.com/2010/06/unpacking-by-hooking/comment-page-1/#comment-690 rage Mon, 14 Jun 2010 12:03:54 +0000 http://blog.reversinglabs.com/?p=676#comment-690 Nice approach! Nice approach!

]]>