PAGE_EXECUTE_WRITECOPY As Anti-Debug Trick

[waliedassar]

Here you can find it

http://waleedassar.blogspot.com/2012/09/pageexecutewritecopy-as-anti-debug-trick.html

Any ideas or comments are more than welcome.

[kakamail]

Your file does not run on my SP2. Sorry i don't have c compiler on my pc.

[waliedassar]

This is due to Microsoft Visual Studio embedding an RT_MANIFEST (24, 0x18) resource in the final executable. This manifest requests a specific version of msvcrt.dll from your winsxs which is apparently not installed on your system.

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">

<dependency>

<dependentAssembly>

<assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.6195" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>

</dependentAssembly>

</dependency>

</assembly>

Install Microsoft Visual C++ redistributable 2005 or just set the RVA and Size of resource table in the PE to zero.

Or take this resource-less version of the demo.

http://code.google.c...Copy_Trick_.exe

Edited September 28, 2012 by waliedassar

[Shub-Nigurrath]

you could compile it as an xADT plugin? Just for fun.

[ghandi]

Minus the SxS attribute, easily changed in the project settings plus using static runtime so that although the resulting binary may be larger it will run on machines regardless of runtime installed.

HR,

Ghandi

[mudlord]

Or you could link against MSVC6 runtimes to remove said dependancy.

Yes, I done it before for my demoscene prods.

[ghandi]

A good point also, possibly even the better approach as it keeps the binary size down as well as linking against runtime that should exist on any XP+ machine.

HR,

Ghandi

[mudlord]

Indeed, MSVCRT.DLL existed during the Win98 days even..o_o

[ghandi]

Sorry for the delayed reply, I said that because XP was the first OS which shipped with it factory, wasn't it? Correct me if i'm wrong but pre-XP the runtime had to be installed to be present, or so i thought, :/

HR,

Ghandi

Edited October 16, 2012 by ghandi

[mudlord]

hmmm, I think it came with 98SE too..., around the same time VC6 was released.

[ghandi]

Nice, thanks for that.

HR,

Ghandi