Confuser.Protections.HoLLy

Confuser.Protections.HoLLy copied to clipboard

Process hollowing

4

I've seen this in practice before. Hollowing an external or the own process would be a neat packer. For more see [this](http://www.autosectools.com/Process-Hollowing.pdf). **EDIT:** This seems to be called RunPE.

holly-hacker

``` [ERROR] Unknown error occurred. Exception: System.NullReferenceException: Object reference not set to an instance of an object. at Confuser.Protections.HoLLy.AntiMemoryEditing.MemoryEditInjectPhase.Execute(ConfuserContext context, ProtectionParameters parameters) in C:\Users\Ro\Visual Studio 2017\Projects12\AntiMemoryEditingPlugin\AntiMemoryEditingPlugin\AntiMemoryEditingPlugin\MemoryEditInjectPhase.cs:line 43 at Confuser.Core.ProtectionPipeline.ExecuteStage(PipelineStage stage,...

RoyIL

Allow choosing between implicit operators and methods for MemoryProtection.

2

Right now MemoryProtection uses [implicit operators](https://github.com/HoLLy-HaCKeR/Confuser.Protections.HoLLy/blob/master/Confuser.Protections.HoLLy.Runtime/AntiMemoryEditing/ObfuscatedValue.cs#L20) to normal values to obfuscated values. Using methods instead of implicit operators adds an additional bit of obfuscation.

holly-hacker

Fix type marking in MemoryEditInjectPhase

2

Calling name.Analyze on one of the types returned from the type injection results in a null reference exception somewhere in VTable analyzer code.

holly-hacker

Fix typo: Change Fake Obfsucator: > ### Fake Obfsucator to "Fake Obfuscator": > ### Fake Obfuscator

HorridModz