Memory Protection

[giangnguyen]

I am looking for a way to set up either VIRTUAL_PROTECT or PAGE_GUARD for memory protection. I currently don't know how to do this, I have made the encryption for my EXE Protector, the RunPE module, and basically everything that I need. I also have made an advanced obfuscation tool, which I might release here on the forums in the future, to make sure the code is impossible to be understood. However, people can dump the original EXE from memory when I am injecting it. So how would I implement VIRTUAL_PROTECT, PAGE_GUARD or other methods of protecting memory?

[Skitty]

lmao this all sounds malicious af m8

at this point why not use a language like C++ or something lol

[Melba23]

giangnguyen,

  Quote

people can dump the original EXE from memory when I am injecting it

Expand  

From the forum rules:

Do not ask for help with AutoIt scripts, post links to, or start discussion topics on the following subjects:
[...]
•Running or injecting any code (in any form) intended to alter the original functionality of another process.

So please explain why I should not close this thread - and it had best be very good!

M23 

[giangnguyen]

It is not intended to alter the original functionality of another process. It just injects code into itself using RunPE. @ScriptFullPath, not @ComSpec or "C:\Windows\Explorer.exe". Therefore it is not injecting code intended to alter the original functionality of another process. 

If I am making something malicious, why would I be interested in Page Guard? I would be more focused in obfuscating and hiding the script if I am a malware writer. Just sayen.

  On 5/2/2016 at 10:59 AM, Skitty said:

lmao this all sounds malicious af m8

at this point why not use a language like C++ or something lol

Expand  

 

It is not malicious, that is the first thing

And I am only learning, and I don't know C++/C yet. Intending to learn them in a few months time.

[Melba23]

giangnguyen,

However, doing so is against the spirit of the rules and so I am going to close this thread. Please continue your education elsewhere.

M23