Question about "Import Protection"
Posted: Sat Mar 05, 2022 4:14 am
im using vmprotect on a dll and my main goal is to prevent attackers from dumping and "fixing" the dll so that it can be injected without my injector.
the main procedure, as far as i know, would be to dump the dll, find relocations and imports and fix it that way. my question is: since "Import Protection" seems to remove the IAT and do it all internally inside of the VMProtect stub, doesnt that make "fixing" the dll easier?
the main procedure, as far as i know, would be to dump the dll, find relocations and imports and fix it that way. my question is: since "Import Protection" seems to remove the IAT and do it all internally inside of the VMProtect stub, doesnt that make "fixing" the dll easier?