I kind of have an idea of what you are talking about, especially where it uses the return address of a call to calculate the correct API to go to :) Only thing they really added in safedisc these days are stolen bytes, (which is where safedisc attatches its own ring 3 debugger to the process, which catches int 3's executed in the code sections and emulates commands that those int 3's had replaced) and a developer API that basically decrypts values that the devs give it. For example, the devs encrypt 2 ints, and then pass it to the Safedisc API, and then it returns two decrypted integers (I might be wrong, but hey thats all I could guess without the original source code :D).

Anyways, I expect the stolen bytes to give sunbeam here a bit of trouble. Why? Well think about it: Its impossible for 2 ring 3 debuggers to debug the same process, right? So the safedisc ring 3 debugger will never attach to the process as long as Olly is debugging it, and the process that Olly is debugging will hang forever waiting for the safedisc debugger to attach. There is a way around this, but it is long and cumbersome (and apparently doesn't work in Vista :( ).

As for securom, well seems like they hired some sadistic motherfuckers to recode the protection for them, lots of new features in it... and I probably haven't found all of them yet ^^

softice m8, or syser, or trw2000 in win2k - safedisc works perfectly with a well hidden softice :)
or coding your own api hooker for both the processes works fine, no drivers used, so they're open for abuse :)

Oh don't worry, I have a simple API hooker that works just fine under Vista, I was referring to my method where I use Olly fails in Vista because it seems to be impossible to detatch from a process in Vista and leave the process running. DebugActiveProcessStop also doesn't work; always returns privilege errors, and I'm running under admin...

maybe you also need debug privs?

Yeah yeah, got that since DebugActiveProcessStop is being executed inside Olly's process, not the target process, and Olly obviously has debug priviliges... it doesn't matter, since like I said the API hooker works fine.

I think this is when I can do the Forum Dance \o/

I do believe the thread is dead :P

Naww, I do believe Sunbeam is still going at it, over and over again, just to prove sheep wrong. I wouldn't be surprised if in a month he produces a working dump.

Am in a really good mood today :D Was playing HL2 and decided to learn a few more things from master's bag (sheep). So I got his "ages" trainer and start playing. Got to the first part in-game where you get a hold of grenades. Well, unlimited ammo + rapid fire = BOOM. Launches tons of grenades and lags the game so baaaaadly, I couldn't help but laugh. Picture this - small room, 2 enemies - you and 500 grenades. Hilarious!!!!

Regarding thread topic, I lost interest in it. It's not worth the time to start-up reading on protections like these. Yeah, you might say they're the "shit". If you already know how to do it, good for you - stop messing around and start releasing then...

Why not to bother with it?

a. none of you will ever use such a protection in a trainer (that's where we all started - sheep using SecuROM-like protections in his trainers - yea right - he didn't know how to bring it into discussion...)

b. I find it retarded to start on a crusade and just learn how to do it only to prove a point - it's not the proof that bothers me (surely bothers you), but the moral behind it...

So, we leave it at "sunbeam is a noob" and we call it a day ;)

Cheers :)

P.S.: Still laughing at the parade (me, you and 500 grenades) xDD