Internal working of NoxenGuard

[-Bl00d-]

i swear that i mentioned like 3 times before these arent from oly.
these arent even dumps. i attached my module scanner, selected the
module i wish to read, and get the live memory

[Margherita]

Thank you for sharing

[Departure]

I say "possible" header because I haven't actually checked it out personally, I am only going what they have posted, its clear it is some sort of structure with padding, and yes $1000 byte offset allocated for the headers would account for the padding, And yes olly does some times misinterpretate the op codes for incorrect asm instructions. Too bad they didn't post the op codes along with the interpretation and then it would be simple to see if it was a header or not. I am not doubting it is a header, I personally haven't checked it out for myself to say 100% nor have seen the op code to say 100% it is the Dos/PE header of an executable. it is also clear they haven't selected to analyze the code with olly, do this and every thing will be alot clearer