Stone's DumpExe Detection Utillity Greetings must go to Bugsy - DumpExe certainly does Roolz! and ofcoz to the allmighty Jammer, whose code I've so shamelessly stolen Why is it interesting to Detect DumpExe? Most crackers I know uses DumpExe when they unpackage EXE-files. This has good reason - DumpExe roolz. However since most crackers have it resident while unpacking EXE-crypters detecting it and acting on it could be used as a *PART* of the antidebugging scheme. I will leave the implementation to whoever is writting exe-crypters nowadays. You are free to steal my code and ideas. How does it work? Method 1) DumpExe hooks INT 9h in order to have direct control over the keyboard. The DumpExe detection utility looks at what code is at where the Int9 vector points and compares it to what DumpExe would like to have there. This method is not reliable since e.g. loading another TSR that hooks int9 and chains DumpExe's vector will fuckup detection, while not funtionability. Method 2) The DumpExe detection utility looks at what code is at where the Int9 vector points and compares it to what DumpExe would like to have there. This is actually the method that DumpExe itself uses to detect if it's loaded already. However simple bytepatching of the DumpExe could deal with this detection solution. But in general I'd think that this method is better than 1). Method 3) Is actually the same as method 2. Just a sligth variation. Method 4) This is actually Jammer's Softice detection ripped and rewritten. What it does is that it searches thru every program loaded on your computer and sees if a the "Bugsy" string is in the right position.