🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.lang.asm.x86
Article #58

Re: Absolute addresses, relative addresses

#58
From: Eric Minso
Date: Wed, 27 Aug 2003 08:23
53 lines
4444 bytes
"Alex McDonald" <alex_mcd@btopenworld.com> wrote in message news:
> > Yes, the program I have to write really looks like a virus.
> >
> > I am a trainee in a IT company, and my training subject is to write an
> > Windows EXE protection program. This program must encrypt the
> > executable's code section and add a decryption routine inside the
> > executable.
> >
> 
> Why? Are they in the virus business? There's plenty of ways to protect their
> intellectual property without writing a virus look-alike. Use a product that
> doesn't look like a virus and that works -- try googling on "exe encryption"
> for examples.

No, they are not in the virus business.
They just want to develop themselve their protection program (and own
the source code). I looked for examples on the internet, but most of
them aren't free.


> > The first approach I tried was to make a kind of winzip
> > self-extractor. The main problem is that a temporary file is required
> > : it is not a very secure solution :-( The other main problem is that
> > it's always crashing :-((.
> >
> > The virus-like approach seems to be the most interesting (and easy)
> > because the decryption job is done in memory and don't need a
> > temporary file. There is also some common virus sources available on
> > the internet, so a part of the job is already done :-)
> 
> Your company would be mad letting you write something based on a virus.

My boss said that it is a way that should be explored.
I am just a trainee :-)


> > The main problem is that it seems that assembly language is required
> > and I still have some troubles with absolute and relative addresses.
> > The other main problem is that I fear my program will be seen as a
> > virus by antiviruses.
> >
> 
> Even more sucking of teeth... if you use any of the widely available virus
> sources, that's definitely true. If you've think you've got problems with
> relative and absolute addresses, just think how it's going to be with the
> police when they visit.

Why ? I do nothing illegal ! I am NOT developing a new virus. I am
looking for a way to protect an EXE file. When I looked for examples
on the internet, the only examples I found were virus-related.

Now, if you have any other idea for protecting executables, I will be
happy to have it.
Technical Details
Message-ID: <7db38e60.0308270023.1d3f4cf@posting.google.com>
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mail
References: <7db38e60.0308250121.6135ebc1@posting.google.com> <bieiii$8dsqb$1@ID-165313.news.uni-berlin.de> <7db38e60.0308260511.4b9a371@posting.google.com> <bigi38$36e$1@titan.btinternet.com>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f7d8d,44f17f79ebe31523
X-Google-Attributes: gidf7d8d,public
X-Google-Thread: feaef,44f17f79ebe31523
X-Google-Attributes: gidfeaef,public
X-Google-Thread: 1093da,44f17f79ebe31523
X-Google-Attributes: gid1093da,public
X-Google-Thread: 114917,44f17f79ebe31523
X-Google-Attributes: gid114917,public
X-Google-ArrivalTime: 2003-08-27 02:57:00 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mail
From: minso@altern.org (Eric Minso)
Newsgroups: comp.lang.asm.x86,alt.lang.asm,alt.os.assembly,borland.public.tasm
Subject: Re: Absolute addresses, relative addresses
Approved: CLAX86 Moderators <ccrayne@crayne.org>
Date: 27 Aug 2003 01:23:22 -0700
Organization: http://groups.google.com/
Message-ID: <7db38e60.0308270023.1d3f4cf@posting.google.com>
X-CLAX86-Policy: http://www.pacificsites.com/~ccrayne/clax86.html
X-CLAX86-Faq: http://www.faqs.org/faqs/by-newsgroup/comp/comp.lang.asm.x86.html
X-CLAX86-Info-1: Send submissions to comp-lang-asm-x86@moderators.isc.org
X-CLAX86-Info-2: Send technical complaints to    ccrayne@crayne.org
X-CLAX86-Info-3: Send complaints about policy to ccrayne@crayne.org
X-Comment: moderators do not necessarily agree or disagree with this article.
References: <7db38e60.0308250121.6135ebc1@posting.google.com> <bieiii$8dsqb$1@ID-165313.news.uni-berlin.de> <7db38e60.0308260511.4b9a371@posting.google.com> <bigi38$36e$1@titan.btinternet.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Spamscanner: mailbox2.ucsd.edu  (v1.2 May 26 2003 01:55:38, -1.0/5.0 2.55)
X-Spam-Level: Level 
X-MailScanner: PASSED (v1.2.7 58948 h7R8NONU079426 mailbox2.ucsd.edu), Found to be clean
X-MailScanner-Information: Please contact the ISP for more information
X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=-1,
 required 4, QUOTED_EMAIL_TEXT -0.48, REFERENCES -0.50)
X-UIDL: :6!"!~~A"!F&F"!a-j!!
X-Complaints-To: abuse@supernews.com
Lines: 54