Reply to thread

Message

<blockquote data-quote="Mecanik" data-source="post: 731162" data-attributes="member: 71056">Thank for you for the many solutions/ideas and the in-depth explanation. However, because I am looking to prevent this from happening in the future as well and because this malware can be in any form ( renamed, repacked, etc ) it is quite hard to identify it by PID or anything else.Hard coding fixed names for the malware is not an options, neither signatures.The only true solution I see here is injecting all the running processes, and do your &quot;thing&quot; there. This will prevent current version, future versions, and any other similar programs.Because this program is &quot;self-protecting&quot;, the only way I could inject it to perform a test of this idea was manual mapping. And I believe that would be an excellent solution to make &quot;sure&quot; you always injected the processes running so you can get a result.The test resulted better than I expected, it is super easy to detect the functions called by the malware. Once you are inside it, you can see and do anything.I would like go to on this &quot;path&quot; as a result. Considering my above questions if this is legal, well who doesn&#039;t do it really... almost all AV companies do it, even some VPN clients like CyberGhost, so why can&#039;t I <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />There are some form of terms and conditions that can be created/included to avoid legal problems for sure.In order for me to obtain a stable and final result I need some help I&#039;m afraid. Even though I know quite some stuff, there are more experienced people here I believe like you [USER=65228]@Opcode[/USER].I need some reliable examples of manual mapping injection, x32 and x64 ( XP =&gt; 10 ). I know it&#039;s not easy to provide an answer considering XP... but my software is running on XP as well.I believe if I can get this part done, I have a strong solution against this problem and other people can learn/benefit how to protect their applications like so.</blockquote>

[QUOTE="Mecanik, post: 731162, member: 71056"] Thank for you for the many solutions/ideas and the in-depth explanation. However, because I am looking to prevent this from happening in the future as well and because this malware can be in any form ( renamed, repacked, etc ) it is quite hard to identify it by PID or anything else. Hard coding fixed names for the malware is not an options, neither signatures. The only true solution I see here is injecting all the running processes, and do your "thing" there. This will prevent current version, future versions, and any other similar programs. Because this program is "self-protecting", the only way I could inject it to perform a test of this idea was manual mapping. And I believe that would be an excellent solution to make "sure" you always injected the processes running so you can get a result. The test resulted better than I expected, it is super easy to detect the functions called by the malware. Once you are inside it, you can see and do anything. I would like go to on this "path" as a result. Considering my above questions if this is legal, well who doesn't do it really... almost all AV companies do it, even some VPN clients like CyberGhost, so why can't I :unsure: There are some form of terms and conditions that can be created/included to avoid legal problems for sure. In order for me to obtain a stable and final result I need some help I'm afraid. Even though I know quite some stuff, there are more experienced people here I believe like you [USER=65228]@Opcode[/USER]. I need some reliable examples of manual mapping injection, x32 and x64 ( XP => 10 ). I know it's not easy to provide an answer considering XP... but my software is running on XP as well. I believe if I can get this part done, I have a strong solution against this problem and other people can learn/benefit how to protect their applications like so. [/QUOTE]

Verification