r0da's blog

A couple of days ago, Valve released a new update for CSGO, that "improve" its already pointless anticheat. And I decided to make a thread about it because it's stupidly funny. The article blur : In this article, they detail  : I will analyse this by paragraphs. So let's start with the second one, they will "restricts" the types of programs and files that can interact with the game. If you don't know CSGO, and common programs behaviour, know that some programs that have overlays like Discord, OBS, Nvidia stuff, need to inject DLLs (see my post about hooking functions ) to execute code in the CSGO process, for overlay purposes. But a cheat is also about injecting and executing a code in CSGO, so VAC Anticheat has to make the difference between a cheat and a legit software like Discord. And during all it's existance, there was false positives made by VAC.  The next paragraph explain that now, if VAC detect that you load an incompat...

Hi Today I will show how I unpacked Jar2Exe protection 3. I made a tool called Exe2Jar that unpack Jar2Exe protection 1 and 2. It was a school project so I didn't look that much to the protection 3, and someone shown me an issue about the output of my program regarding protection 3. So I decided to rework on it, and implement the protection 3 support. Exe2Jar : https://github.com/whereisr0da/exe2jar So if you're not familiar with Jar2Exe, know that the JAR File are stored in the Exectuable's Resources since protection 2. Just to prove my point, here is the original JAR File size on the left and the file size of the Encrypted RCDATA resource on the right. We have to see how the executable handle resource. So resources are used with functions like FindResourcesA etc... And as we can see, those functions are imported in the executable. We just have to follow them to see where there are used. In particular the FindResourcesA that ret...

Hi Today I will present my current project Serana Serana Serana is a .NET library that can parse windows executables This library interpret all elements of the executable and represent them in a Object Programming way So you can get any informations of a PE structure and modify each one of them (in the future) These objects could be exported (raw file buffers) separately after modifying them or export the entire executable git : https://github.com/whereisr0da/Serana-Lib Why I know, I know ... there is a lot of library like this. I like use pefile in python, but in .NET there is not that much about PE files, there is libs for .NET such as Mono, dnlib. I made this to improve my PE knowledge. Currently Now this library support only the reading / parsing of executables. So you can use this to take informations about all structures of the PE. The export function work but its useless because nothing can be modify. How You can read informations about the ex...

This is a part of my tutorial on how to protect windows executables, so is a little bit disconnected from my others posts, but in wait of my big tutorial I publish this anyway. Something that you can apply with the others encryption tricks in PE files is the encryption of function, and decrypting at calling time. I found this trick with the Zer0Mem0ry post originaly made to bypass memory signatures checks by encrypt functions at runtime. With random xor, so A big thanks to this good guy 😃 But wait, why use function encryption if we can just encrypt segments, In my point of view, if you make the all segments encrypted, the dissasembler will see only functions related to the decryption of the segments. So immediately you will see where the code is decrypted, I think that having a lot of functions is more efficient in this case. There is a lot of " pros and cons " about this trick and I will discuss a bit about them at the end This is, again, to make at the ...