Anti-Disassembly

Thwarting Stack-Frame Analysis is a technique used by malware to make it more difficult for security analysts to reverse engineer and analyze the code. A stack frame is a collection of data associated with a function, including local variables, arguments passed to the function, and the return address. Disassemblers can use information from the stack frame to understand a function's …

Packers

Themida is a commercial known packer that embeds several features including anti-debugging, virtual machine emulation, encryption...

• Anti-debugger techniques that detect/fool any kind of debugger

• Anti-memory dumpers techniques for any Ring3 and Ring0 dumpers

• Different encryption algorithms and keys in each protected application

• Anti-API scanners techniques that avoids reconstruction …

Packers

Alienyze is a software packer designed to compress executable files, allowing them to reduce the file size of their software as much as possible.

• Anti-Debugger techniques that detect and fool present debuggers

• Anti-VM techniques that detect sandbox & virtualized environments

• Protection from disassemblers and software analysis tools

• Hardware …

Packers

.NET Reactor is used to prevent reverse engineering by adding different protection layers to .NET assemblies. Beside standard obfuscation techniques it includes special features like NecroBit, Virtualization, x86 Code Generation or Anti Tampering.

Process Manipulating

It is possible to change the name of the current process or any of its modules at runtime. This is achieved by accessing the process PEB's member 'Ldr', in particular it has a member 'InOrderMemoryLinks' which we can iterate through to get a list of the process's modules.

On each iteration it gets a PLDR_DATA_TABLE_ENTRY structure to work with …