Full Version: Seh Frames Protection
extreme
Is there any tool or way(tutorial) to do this?? Someone told me that this is a nice way of making file "dynamic"..
nolimit
could you perhaps explain what you want better? Their are SEH chains, established in stack frames. But what do you mean by keeping the file dynmic?
extreme
I was exploring modifications of files to see which method bypasses which AVs, and I only got clue that SEH frames protection is the key for NOD bypass.. And I couldn't figure out how to get a result out of this clue
z0mbi3
i was thinking what nolimit said

found these might be useful

http://www.madchat.org/vxdevl/papers/winsys/seh.txt
nolimit
Maybe you mean using the default SEH as a method of starting code you've placed in the executable?
extreme
Maybe you can give some live example?
z0mbi3
QUOTE(extreme @ Jun 21 2005, 09:39 PM)
Maybe you can give some live example?
*



If thats to me,I don't know much about seh in files to bypass a/v's so i googled it and found that link.
nolimit
ehh
find codecave in EXE,
write virus to code cave.
overwrite FS:[4] of main thread to point to the newly written code cave.

When an exception occurs in the main thread, KiUserExceptionDispatcher will dispatch to the default SEH handler, which you overwrote in FS:[4].

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.

 
Invision Power Board © 2001-2005 Invision Power Services, Inc.