From Collaborative RCE Tool Library
Anti Anti-BPM via SEH, KiUserExceptionFilter Mod
| Tool name: | Anti Anti-BPM via SEH, KiUserExceptionFilter Mod |
|
||
|---|---|---|---|---|
| Author: | Robert Yates | |||
| Website: | http://www.reverse-engineering.info | |||
| Current version: | ||||
| Last updated: | August, 2003 | |||
| Direct D/L link: | http://www.reverse-engineering.info/SystemCoding/bpm.rar | |||
| License type: | ||||
| Description: | This is an idea I had and tried to put into practice. Some protections create faults so they can clear bpms, Asprotect for example, so the idea behind this sys is to modify KiUserExceptionDispatcher to create a snapshot of the drx regs before the users exception occurs then restore them afterwards. It works but the src is rough, currently you have to disassemble ur own ntdll and find some un-used space, (6 dwords) at the end off the .data then subtract the ntdll imagebase and update the NTDT EQU in the .sys. The idea could be improved by only restoring drx values that have become null or the standard dr7 value re-entered. Have a go, bpm w the code section of an asprotect exe after the sys is loaded. |
|||
| Related URLs: | No related URLs have been submitted for this tool yet | |||
Feed containing all updates for this tool.
(please also edit it if you think it fits well in some additional category, since this can also be controlled)
You are welcome to add your own useful notes about this tool, for others to see!