+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: Visual Basic & .NET Framework (https://sinister.ly/Forum-Visual-Basic-NET-Framework)
+--- Thread: [Tips] simple anti-dump (/Thread-Tips-simple-anti-dump)
[Tips] simple anti-dump - LaTortue - 08-06-2016
This code will removing the Portable Executable Header at runtime, this work only on console application (I do not know why 
)
![[Image: bZZmaZU.png]](http://i.imgur.com/bZZmaZU.png)
Download:)https://gist.github.com/TortegaFR/1a9bcf5f8953978a484527ee4247f3a3
RE: [Tips] simple anti-dump - Killpot - 08-06-2016
This isn't really secure man, just removing headers won't stop anyone with a few brain cells, they're very easy to reconstruct. You're also assuming x86 architecture, what about x64 or Any? That and you're not even restoring the old protection. If you want something done properly use this: http://www.unknowncheats.me/forum/vb-net/115224-simple-anti-dump-method-net.html
RE: [Tips] simple anti-dump - Wildfire - 08-06-2016
It's clever, but not impenetrable. I made a short video on this, only adding a pause so I can inject the DLL (obviously you would call the protector function after you loaded DLL from memory (not disk because that defeats the purpose), but I had to do it by hand and didn't have a memory injector on hand)
RE: [Tips] simple anti-dump - Killpot - 08-06-2016
(08-06-2016, 10:29 PM)Axari Wrote: It's clever, but not impenetrable. I made a short video on this, only adding a pause so I can inject the DLL (obviously you would call the protector function after you loaded DLL from memory (not disk because that defeats the purpose), but I had to do it by hand and didn't have a memory injector on hand)
Could have just started the program as suspended and dumped everything before the protection even started, hell you could even open the program in .Net Reflector and remove the check.
RE: [Tips] simple anti-dump - Wildfire - 08-06-2016
(08-06-2016, 10:34 PM)Killpot Wrote:(08-06-2016, 10:29 PM)Axari Wrote: It's clever, but not impenetrable. I made a short video on this, only adding a pause so I can inject the DLL (obviously you would call the protector function after you loaded DLL from memory (not disk because that defeats the purpose), but I had to do it by hand and didn't have a memory injector on hand)
Could have just started the program as suspended and dumped everything before the protection even started, hell you could even open the program in .Net Reflector and remove the check.
Very true, but I was lazy and adding a pause in there was easier than calling a suspend function
