Article View: comp.lang.asm.x86
Article #58Re: Absolute addresses, relative addresses
From: Eric Minso
Date: Wed, 27 Aug 2003 08:23
Date: Wed, 27 Aug 2003 08:23
53 lines
4444 bytes
4444 bytes
"Alex McDonald" <alex_mcd@btopenworld.com> wrote in message news: > > Yes, the program I have to write really looks like a virus. > > > > I am a trainee in a IT company, and my training subject is to write an > > Windows EXE protection program. This program must encrypt the > > executable's code section and add a decryption routine inside the > > executable. > > > > Why? Are they in the virus business? There's plenty of ways to protect their > intellectual property without writing a virus look-alike. Use a product that > doesn't look like a virus and that works -- try googling on "exe encryption" > for examples. No, they are not in the virus business. They just want to develop themselve their protection program (and own the source code). I looked for examples on the internet, but most of them aren't free. > > The first approach I tried was to make a kind of winzip > > self-extractor. The main problem is that a temporary file is required > > : it is not a very secure solution :-( The other main problem is that > > it's always crashing :-((. > > > > The virus-like approach seems to be the most interesting (and easy) > > because the decryption job is done in memory and don't need a > > temporary file. There is also some common virus sources available on > > the internet, so a part of the job is already done :-) > > Your company would be mad letting you write something based on a virus. My boss said that it is a way that should be explored. I am just a trainee :-) > > The main problem is that it seems that assembly language is required > > and I still have some troubles with absolute and relative addresses. > > The other main problem is that I fear my program will be seen as a > > virus by antiviruses. > > > > Even more sucking of teeth... if you use any of the widely available virus > sources, that's definitely true. If you've think you've got problems with > relative and absolute addresses, just think how it's going to be with the > police when they visit. Why ? I do nothing illegal ! I am NOT developing a new virus. I am looking for a way to protect an EXE file. When I looked for examples on the internet, the only examples I found were virus-related. Now, if you have any other idea for protecting executables, I will be happy to have it.
Technical Details
Message-ID:
<7db38e60.0308270023.1d3f4cf@posting.google.com>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mailReferences:
<7db38e60.0308250121.6135ebc1@posting.google.com> <bieiii$8dsqb$1@ID-165313.news.uni-berlin.de> <7db38e60.0308260511.4b9a371@posting.google.com> <bigi38$36e$1@titan.btinternet.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: f7d8d,44f17f79ebe31523 X-Google-Attributes: gidf7d8d,public X-Google-Thread: feaef,44f17f79ebe31523 X-Google-Attributes: gidfeaef,public X-Google-Thread: 1093da,44f17f79ebe31523 X-Google-Attributes: gid1093da,public X-Google-Thread: 114917,44f17f79ebe31523 X-Google-Attributes: gid114917,public X-Google-ArrivalTime: 2003-08-27 02:57:00 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mail From: minso@altern.org (Eric Minso) Newsgroups: comp.lang.asm.x86,alt.lang.asm,alt.os.assembly,borland.public.tasm Subject: Re: Absolute addresses, relative addresses Approved: CLAX86 Moderators <ccrayne@crayne.org> Date: 27 Aug 2003 01:23:22 -0700 Organization: http://groups.google.com/ Message-ID: <7db38e60.0308270023.1d3f4cf@posting.google.com> X-CLAX86-Policy: http://www.pacificsites.com/~ccrayne/clax86.html X-CLAX86-Faq: http://www.faqs.org/faqs/by-newsgroup/comp/comp.lang.asm.x86.html X-CLAX86-Info-1: Send submissions to comp-lang-asm-x86@moderators.isc.org X-CLAX86-Info-2: Send technical complaints to ccrayne@crayne.org X-CLAX86-Info-3: Send complaints about policy to ccrayne@crayne.org X-Comment: moderators do not necessarily agree or disagree with this article. References: <7db38e60.0308250121.6135ebc1@posting.google.com> <bieiii$8dsqb$1@ID-165313.news.uni-berlin.de> <7db38e60.0308260511.4b9a371@posting.google.com> <bigi38$36e$1@titan.btinternet.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Spamscanner: mailbox2.ucsd.edu (v1.2 May 26 2003 01:55:38, -1.0/5.0 2.55) X-Spam-Level: Level X-MailScanner: PASSED (v1.2.7 58948 h7R8NONU079426 mailbox2.ucsd.edu), Found to be clean X-MailScanner-Information: Please contact the ISP for more information X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=-1, required 4, QUOTED_EMAIL_TEXT -0.48, REFERENCES -0.50) X-UIDL: :6!"!~~A"!F&F"!a-j!! X-Complaints-To: abuse@supernews.com Lines: 54