You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi there! If you want to extract feature codes (or patterns), you'll need a PE editor or debugger like x64dbg first. Next, select some consecutive machine code within the function and calculate the distance between its start address and the first byte of your choice. It's important to choose complex instructions to ensure the patterns you pick are unique within the module's segment.
Activity
[-]请问一下内存加载dll，有什么办法做隐藏效果[/-][+]想用之前没有MmpTls的版本来加载版本号为21H1[/+][-]想用之前没有MmpTls的版本来加载版本号为21H1[/-][+]想用之前没有MmpTls的版本来加载版本号为21H1的win10[/+]bb107 commentedon Feb 21, 2022
是的，你需要手动提取LdrpHandleTlsData和LdrpReleaseTlsEntry的特征码。
jackyuke commentedon May 15, 2023
How to extract feature code? Any guidance?
bb107 commentedon May 15, 2023
Hi there! If you want to extract feature codes (or patterns), you'll need a PE editor or debugger like x64dbg first. Next, select some consecutive machine code within the function and calculate the distance between its start address and the first byte of your choice. It's important to choose complex instructions to ensure the patterns you pick are unique within the module's segment.
jackyuke commentedon May 24, 2023
Trying to load more dll at once. It it exceeds InvertedTable->MaxCount. Can we increase it?
bb107 commentedon May 24, 2023
As far as I know, INVERTED_FUNCTION_TABLE is a fixed size struct and is not dynamically allocated, so we cannot increase its size.