Click here to Skip to main content
15,904,494 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
PraiseRe: How to use a variable declared in another class in Visual C++ Pin
_Flaviu16-Mar-17 21:37
_Flaviu16-Mar-17 21:37 
GeneralRe: How to use a variable declared in another class in Visual C++ Pin
Munchies_Matt16-Mar-17 21:44
Munchies_Matt16-Mar-17 21:44 
GeneralRe: How to use a variable declared in another class in Visual C++ Pin
lolici17-Mar-17 11:23
lolici17-Mar-17 11:23 
QuestionIs it possible to find if an application is encrypted at runtime Pin
manoharbalu15-Mar-17 2:42
manoharbalu15-Mar-17 2:42 
AnswerRe: Is it possible to find if an application is encrypted at runtime Pin
Jochen Arndt15-Mar-17 3:00
professionalJochen Arndt15-Mar-17 3:00 
GeneralRe: Is it possible to find if an application is encrypted at runtime Pin
manoharbalu15-Mar-17 3:16
manoharbalu15-Mar-17 3:16 
GeneralRe: Is it possible to find if an application is encrypted at runtime Pin
Jochen Arndt15-Mar-17 3:28
professionalJochen Arndt15-Mar-17 3:28 
AnswerRe: Is it possible to find if an application is encrypted at runtime Pin
Randor 15-Mar-17 13:21
professional Randor 15-Mar-17 13:21 
Hi,

manoharbalu wrote:
Is it possible to write a code inside the application to find it at runtime.


Maybe.

manoharbalu wrote:
Can anyone help me in this regard


One of the first thing at occurs after the executable begins execution... (For brevity I will not describe the NT loader) is that it jumps to the IMAGE_OPTIONAL_HEADER.AddressOfEntryPoint and begins executing some code there.

Do the following:
1.) Protect around a dozen files with the packer/protector.
2.) Read some bytes at the IMAGE_OPTIONAL_HEADER.AddressOfEntryPoint offset on all these protected files. (maybe 16 bytes of instructions)
3.) Save those bytes into an array.
4.) If all those bytes are the same... use that for your signature detection.

All PE packers and protections add the decryption/decompressing functions at the IMAGE_OPTIONAL_HEADER.AddressOfEntryPoint

Note that in the old days some vendors used polymorphic instruction generators to avoid detection... but these days most vendors are using static instructions so that anti-virus vendors can detect the unpacker signature.

Note that you can also iterate through the PE sections...
A typical PE file from a Microsoft based compiler will contain:
.text
.bss
.rdata
.data
.idata
.reloc
... few others


I believe the HASP SRM packer/protector generates an additional PE section:
.protect

Keep in mind that you are performing a statistical analysis so...
if the instructions at IMAGE_OPTIONAL_HEADER.AddressOfEntryPoint are the same as instructions from other binaries packed with HASP SRM
{
    if There is an additional section named .protect which is consistent with the HASP SRM product.
    {
        Probably protected by HASP SRM
    }
}


Best Wishes,
-David Delaune

modified 17-Mar-17 14:38pm.

QuestionProblem with List Control in visual c++ Pin
lolici14-Mar-17 4:32
lolici14-Mar-17 4:32 
AnswerRe: Problem with List Control in visual c++ Pin
Jochen Arndt14-Mar-17 4:46
professionalJochen Arndt14-Mar-17 4:46 
GeneralRe: Problem with List Control in visual c++ Pin
lolici14-Mar-17 5:23
lolici14-Mar-17 5:23 
QuestionHow to move window with no border using picture control Pin
Premnath Mali9-Mar-17 20:03
professionalPremnath Mali9-Mar-17 20:03 
QuestionRe: How to move window with no border using picture control Pin
Richard MacCutchan9-Mar-17 21:13
mveRichard MacCutchan9-Mar-17 21:13 
AnswerRe: How to move window with no border using picture control Pin
Premnath Mali9-Mar-17 21:46
professionalPremnath Mali9-Mar-17 21:46 
GeneralRe: How to move window with no border using picture control Pin
Richard MacCutchan9-Mar-17 21:57
mveRichard MacCutchan9-Mar-17 21:57 
SuggestionRe: How to move window with no border using picture control Pin
David Crow10-Mar-17 5:49
David Crow10-Mar-17 5:49 
AnswerRe: How to move window with no border using picture control Pin
Randor 16-Mar-17 18:45
professional Randor 16-Mar-17 18:45 
AnswerRe: How to move window with no border using picture control Pin
leon de boer10-Mar-17 16:21
leon de boer10-Mar-17 16:21 
QuestionMFC C++ Compiler Options difference between the debug and release Pin
ForNow5-Mar-17 15:41
ForNow5-Mar-17 15:41 
QuestionRe: MFC C++ Compiler Options difference between the debug and release Pin
David Crow5-Mar-17 16:25
David Crow5-Mar-17 16:25 
AnswerRe: MFC C++ Compiler Options difference between the debug and release Pin
ForNow5-Mar-17 16:36
ForNow5-Mar-17 16:36 
GeneralRe: MFC C++ Compiler Options difference between the debug and release Pin
Richard MacCutchan5-Mar-17 21:02
mveRichard MacCutchan5-Mar-17 21:02 
GeneralRe: MFC C++ Compiler Options difference between the debug and release Pin
Munchies_Matt16-Mar-17 6:22
Munchies_Matt16-Mar-17 6:22 
GeneralRe: MFC C++ Compiler Options difference between the debug and release Pin
Richard MacCutchan16-Mar-17 6:33
mveRichard MacCutchan16-Mar-17 6:33 
GeneralRe: MFC C++ Compiler Options difference between the debug and release Pin
Munchies_Matt16-Mar-17 6:37
Munchies_Matt16-Mar-17 6:37 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.