Kek, just hang up skidmarks like medals on their wall

My friend works in NSA. He teaches me

which thing?

anti hooking stuff

why would you make the SHA512 of a function?

becuz they cant change assembly code of it

so?

well I want to see how you use those functions

the one you compressed

hmm i will get hash of a function then if somebody changes the function or ... the timer will find the prevous hash is not equal with new hash becuz new hash comes from function being changed

won't work

since those hashes can be changed at runtime

nope

becuz assembly of function will not change but after changign assembly with debugger will change

what?

Instead, I want you to change one function with gdb, then hash the function and change the hash you had stored for that function in memory

they dont know where is hashed code

a good RE does

its not string

but it is compared against

but it is compared against

can alter comparasion itself, no need to touch hash

somewhere you have a cmp WORD[f_hash_pointer], WORD[required]

well i will not use cmp or something i will use virtualized codes

how do you compare against the required hash then?

what is that?

GOOGLE maxyyy :D

vmprotect looks like a bad idea

"VMProtect doesn’t decrypt the code at all! Instead, the encrypted code runs on a virtual CPU that is markedly different from generic x86 and x64 CPUs as the command set is different for each protected file."

not a problem for binary ninja

not a problem for binary ninja