Only Starforce I looked at was the protected notepad with basic SF 4.7, and that was pretty normal IAT redirection for these days.... and obfuscation is pretty common these says too. Only thing that isn't the norm are VM's, but they'll probably be the most popular protection method in the future.
Quote:
|
Themida used a ring0 driver in itīs very first release. but due compatibility reasons they dropped it, developed a VM and went ring3
|
Yep
It was quite a pity too, now anyone with olly can take a crack at it