CreateFileA, the mother of all self-checks

[taos]

simple, hooking createprocess too.
You can hook anything.

[gigaman]

Some applications perform the self-check also in memory (i.e. simply reading the memory of some sections) - it won't be easy to hook, as it doesn't use any API functions.

Not all applications implement self-checking code by checking themselves on the file system. Others do their checking in memory.

Shade

For Asprotect and sure for Armadillo as well i saw 2 inline patchers made by GlObAl that uses the .bak method to kill asprotect and armadillo crc checks... i'm sure he could help us to understand how this work.. maybe someone who knows him would like to contact him and ask him gently to share information for this with us ...

Asprotect Inline Patch Helper v01.05.2002 (AIPH) has the following info.

""So i began to try inlinepatching ASPR targets with some help from Silberfuchs.
He was at this time able to IP it but his patches didn't work on other systems so we worked
together on it and figured out a method to IP ASPR programs by using an *.bak file
so the protected programs checked the CRC on that file instead of the patched file.
I began to make the IP more combatible and optimized it more and more
so it worked without *.bak file and on w9x / nt / w2k / xp !""

btw i'm not sure if GlObAl and Silberfuchs are members of this board but you can catch them at RCE board ...

also so far i know the owner ( [NtSC]) of this site---> hxxp://mitglied.lycos.de/ntsc2k2/ knows GlObAl if bad don't remember one of his last work was to make Asloader (generic loader for asprotected targets) which mem. patch asprotect without using any special trick.. it just patch it.

Regards

[MaRKuS-DJM]

Originally Posted by ShadeOfRed

Not all applications implement self-checking code by checking themselves on the file system. Others do their checking in memory.

Shade

yeah, that's right. but most of this can be found through a breakpoint > memory > on access and then it is done.

Regarding ASProtect inline patches: BetaMaster informed me that Revenge Crew did an Inline Patch for ISO Commander 1.4.091 without a bak-file or anything. they were able to fix the checksum and so inline-patch it.