Page 3 of 3

Posted: Fri Sep 02, 2005 1:18 pm
by PB
> I just think you should have noticed that when you see the Ashserv wich is
> an avast service

I did notice that but thought it was simply Avast doing a real-time file check
of a file that UPX decompressed to Temp. That's why I thought UPX wasn't
unpacking/running in memory. My mistake, but as you can see, I wasn't
intentionally telling lies.

I'll admit I took too much offense to your comments. The situation is this:
I'm currently sick with the flu, and off work (since Tuesday). I'm only paid
casual and don't get paid for these 4 days off, so I'm losing a lot of money
this week. Then I get told I'm telling "bullshit" on my favorite forums... so
you can see why I reacted angrily. :) Anyway, let's just forget it... I take
back what I said about staying away from me in future. I'm sorry I said it.

Posted: Fri Sep 02, 2005 1:20 pm
by thefool
PB wrote:> I just think you should have noticed that when you see the Ashserv wich is
> an avast service

I did notice that but thought it was simply Avast doing a real-time file check
of a file that UPX decompressed to Temp. That's why I thought UPX wasn't
unpacking/running in memory. My mistake, but as you can see, I wasn't
intentionally telling lies.

I'll admit I took too much offense to your comments. The situation is this:
I'm currently sick with the flu, and off work (since Tuesday). I'm only paid
casual and don't get paid for these 4 days off, so I'm losing a lot of money
this week. Then I get told I'm telling "bullshit" on my favorite forums... so
you can see why I reacted angrily. :) Anyway, let's just forget it... I take
back what I said about staying away from me in future. I'm sorry I said it.
Oh.. Well again i will apologize as it wasnt bullshit.. Sound like your life isnt too funny at the moment..
K lets forget it :)

Posted: Fri Sep 02, 2005 7:21 pm
by okasvi
UPX just unpacks runtime... |:

it does encrypt file and reloc EP to end of file where it will decrypt it and then goes pack to EP... or something like that |:

and that loadexe example does create new process with CREATE_SUSPENDED and then it does write exe to memory of created process and then jumps into its EP i guess... |:

still im looking for help to inject code to another running process (no dll) |:

Posted: Fri May 26, 2006 7:44 am
by Maxus
Greetings.
Well still to whom be interesting this theme?
Who could be to start EXE not writing down on HDD?

I have tried to realize it and at me which that has turned out.