This method does not stop dumping memory to a file. This trick instead prevents the reverser from easily understanding the dumped data. Here are some examples of how this could be applied:
-
Portions of the PE header have been modified, so that the process dump gives the wrong properties.
-
Portions of PEB, such as SizeOfImage, have been modified, so that the process dumping tool dumps wrong.
-
Dumping is very useful for seeing decrypted data. Anti-dumping tricks would re-encrypt the decrypted code or data after use.
To overcome this trick, we can either identify or skip the code that modifies data. For re-encryption, we can also skip the code that re-encrypts, to leave it in a decrypted state.
