3 ms·
How is the VEH target not immediately visible during static analysis?
by 15155 3y ago
How is the VEH target not immediately visible during static analysis?
- aetherspawn 3y agoThe VEH target is visible if you know where to look. You can use something like Themida to virtualize/obsfucate the VEH if you really need the VEH to be encrypted. It's actually not so easy to find the VEH because if you are injecting the VEH into a third party process from another process, then not only does the VEH not exist during static analysis of the binary at rest, but its program address changes on each execution. Moreover, the VEH can be encrypted at rest before it is injected into the second process.