Hello and welcome to a new section on intro to software protection.
We are going to look at what is software plantation ESG packing purpose how to defeat some reputation
while he's unpacking how do the tech savvy reputation execute.
Here's a program he's tender process of unpacking and EMC and some debugging plugins sovereign protection
his protection of software against piracy or use and reverse engineering and the two main ways to protect
software is using and debugging which is to prevent the bugs from touching or analyzing Oh the second
ways by packing which is to compress the software whilst retaining his ability to execute.
Is he back he is ready executable is compressed to a smaller size and he is protecting a using entity
bugging techniques to prevent reversing it reversing will move backer protector is commonly referred
as Packer has ambos back inside.
UBS is protecting our money to VM protect etc. The purpose of banking easy is to prevent reverse engineering
to extract the correct license ice hierarchy and to defeat the static is assembly to make dynamic debugging
more difficult.
Begging yes you also reduce the executable file size how to defeat self-protection first for started
easy to use and packing unpacking is value letting the program and compress yourself into memory and
then a strengthened original EIC from memory and dumping into a newly file.
Then you create a patch for the new AC and none of these two use loaders.
This is also known as runtime patching.
Here you patch the process in memory instead of putting a file.
We used to load it to start the program and wait for it to uncompressed itself into memory.
The loader would then pass the process whilst it is still running in memory while he's unpacking and
packing is very straight harsh in binary from the pack 60 will file automatically on packets ages for
popular packets by mean all in different versions and not also available for complex packets.
And this also involves life debugging by defeating anti debugging techniques detection or better the
apathetic tech testing PIV NDA.
These detectors can detect popular peddlers and also show the evolution of the pecker and also preview
it to say be 82 in B view.
Two examples of screenshots of battle detectors detected e Internet and b idea on the right structure
the b file.
This is stretching before packing.
We have the origin entry point and program we start running here after it has been packed the origin
entry point and only instructions here are compressed in the origin entry by now is inside here.
The package will put a new entry point so if any program run it will jump to the technical possible
as a stop and the particle will again and compress it back.
The original file into memory so that it becomes like this.
Then we prosecute so there is a way we have difficulty patching the backfire because the pay file is
in a compressed ID and there are several types of beggars.
Taiwan is the simplest bike of all and is unable to be x type 2 contains multiple backing the time tree
is similar to intact too but he was in more complex structures like loops and also different courts
like integrity checks and debugging and so on.
An example will be b e can pay yes pay s protection aspect and so on.
Therefore there is either a single home ideally a banking in which a portion of the Beckel could not
responsible for unpacking is in the lead view the execution of the original program is unable is easy.
People attacked if I firefighter is an entirely regular review and taking good leave usually always
in the program.
Example is media types expect a most complex that way.
The Undertaker and bass fragments of the code at any given time during the execution.
An example is Armadillo that Alan Packer is way pressurization in being use on his trash in translation
to avoid the R is no good.
From the I suppose in a memory is an Bowser time meter and VM protect the assertion of a bank program.
Like this assertion with stock from the new OCP which is the IP of this damn hardy and Becker.
And then you push the EVP and some of the registers to the stack.
Then on the back sessions are unpacking memory.
Then you resolve a part address table or IP on it.
How is executable file Heidi is the news of time in libraries which is being used by the program.
It will restore the horror that Ridge's estate is using but it is in how pop EVP session.
And then finally you adjunct here at OCP to begin the actual execution.
A single push ADR session is equivalent to only pushes.
The most important is AVP a single pot that is Russian is equivalent to holding instructions and the
most important is pop EVP probably VB so we can train.
Wendy pecker is about to return instruction to the straight that he AC fa.
Now this is what he looks like when the batter is about to return instruction do the backfire.
When it program for starts you will start with the instruction for the batter before the batter starts.
You will push UVB to this day so that he can return to it once it has a strike that the original.
Yes he found and then just before he goes to the straight and far to execute it.
He will pump.
He may be so.
This is how you can make use of this characteristic to track when the vacuum has finish unpacking and
is about to turn to the abstracted ESEA to execute.
You can put hardware and find on EVP now the standard process on backing ESEA is like this year with
about BSE to find the real or b there was a only you dump the fully intact program to disk then you
fix the entire DBA and if necessary possibly it be here now unpacking using SD if only be for us we
look in the back GSE interfaces for debug then we start tracing the AC to you and kinda pushing 80 push
UVB instruction then you it have a big fine only BBB address in the stack next you press F nine to continue
the execution you will break on the instruction which is immediately after the pump and on proper instruction
then you press F5 understand tracing as soon you encounter jam and jam destruction which we jump to
the divine in it hurry up again.
Once your father and your baby and done the whole program using SC for the B scale are plugging so dumping
is a process of extracting the obvious now easy far and saving into a separate fund.
After you have done that you need to fix the important receiver set and the new AC fan will know where
to look for the DLR library study needs now.
So if indeed you do devaluing plugins and debugging his van the software is sound the text that evaluates
attention and therefore will refuse to execute and there are too many popular plugins which can defeat
these debugging DSR.
Thank you for this lesson in a nice lesson too is that our protocols Fudan.