IDontCode
/
vmhook-eac
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Update README.md

Browse Source
merge-requests/1/head
_xeroxz 3 years ago
parent 105a161fc8
commit 92b6230b51
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File

6
README.md
Unescape View File

@ -27,6 +27,12 @@ Integrity checks outside of the VMProtect 2 virtual machine are not effected by
Thus a hook is placed on this SHA1 hash function and spoofed results are computed... Thus a hook is placed on this SHA1 hash function and spoofed results are computed...
### Solution, Possible Alternatives
If EasyAntiCheat were to patch their own driver using `MmMapIoSpaceEx` - `PAGE_READWRITE` (for HVCI support), they could compute a SHA1 hash, then revert the changes, compute a second SHA1 hash...
If the hashes are the same, then you know someone is hooking SHA1, or hooking `READQ/DW/B` virtual instructions...
### How To Update ### How To Update
These vm handler indexes are for EasyAntiCheat.sys 6/23/2021, when the driver gets re-vmprotected these vm handler indexes need to be updated. These vm handler indexes are for EasyAntiCheat.sys 6/23/2021, when the driver gets re-vmprotected these vm handler indexes need to be updated.

Write Preview
Loading…
Cancel
Save