Unpacked & Unvirtualized Ehsvc.dll Version_5.7.6.502 New Updated!!

Credit to LCF -AT & Deathway.

Author: alanlei

Hello,
Welcome to my bloGGer!!

////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Usage    : Analyzing HackShield HeartBeat and detection
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

If you guys want to analyze HackShield ,feel free to take it!

( 1.) Unpacking Themdia.
( 2.) Unvirtualized VM code of Ehsvc ordinary #10 and #16.
( 3.) Set the Kernel Fix
( 4.) +reloc addy

Remark:
Ehsvc ordinary#10 Addy (Service Dispatch): 
20bc3020
Ehsvc ordinary#16 Addy (HeartBeat_MakeResponse): 
20bc2650

Download:

http://www.mediafire.com/download/7787vnli2d3ohe1/ehsvc_dumped.rar