|
Full Version: Seh Frames Protection
Is there any tool or way(tutorial) to do this?? Someone told me that this is a nice way of making file "dynamic"..
could you perhaps explain what you want better? Their are SEH chains, established in stack frames. But what do you mean by keeping the file dynmic?
I was exploring modifications of files to see which method bypasses which AVs, and I only got clue that SEH frames protection is the key for NOD bypass.. And I couldn't figure out how to get a result out of this clue
i was thinking what nolimit said
found these might be useful http://www.madchat.org/vxdevl/papers/winsys/seh.txt
Maybe you mean using the default SEH as a method of starting code you've placed in the executable?
Maybe you can give some live example?
ehh
find codecave in EXE, write virus to code cave. overwrite FS:[4] of main thread to point to the newly written code cave. When an exception occurs in the main thread, KiUserExceptionDispatcher will dispatch to the default SEH handler, which you overwrote in FS:[4]. This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
|
|