ANTI-UNPACKER TRICKS - PART TEN
Peter Ferrie · 2010
MagicHideOllyDbg is a shameless theft of code from the HideOD plug-in. All but fi ve of the important routines are byte-for-byte identical to HideOD. In fact, the autorun option still calls itself HideOD. One routine is different from HideOD because it contains an introduced bug. The bug is in the OutputDebugStringA code, which has been renamed to ‘OutDebugStringA’. Since no such API exists in Windows, the protection against the OllyDbg OutputDebugStringA exploit is not enabled. Three more routines are different from HideOD thanks to a different compiler setting which has produced slightly different, but functionally equivalent code. The other routine is different because the order of the options checking has been changed. In addition, two new routines have been introduced.