Jump to content

now im really not happy Anti deballs protection


Go to solution Solved by AnotherLurker,

24 posts in this topic

Recommended Posts

Posted

Go through all the xrefs and find the function which has _getpid and _memset near _sysctl. That's the one.

 

Then you'll need to NOP an instruction similar to MOVS R1, 0x1F or something quite similar.

Posted

Go through all the xrefs and find the function which has _getpid and _memset near _sysctl. That's the one.

 

Then you'll need to NOP an instruction similar to MOVS R1, 0x1F or something quite similar.

i looked closely and nope all of them are spread every where 

Posted

i looked closely and nope all of them are spread every where

 

As long as they're in the same function, it'll work

Posted (edited)

As long as they're in the same function, it'll work

im so F******* mad none of them are in the same function there is a close on sysctl and getpid are pretty close together but not in the same function

 

edit sysctl is sub_A347D0 and get pid is Sub_A34784

Updated by Taylor Meyer
Posted

im so F******* mad none of them are in the same function there is a close on sysctl and getpid are pretty close together but not in the same function

 

edit sysctl is sub_A347D0 and get pid is Sub_A34784

Find the instruction and nop it then try

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines