flat assembler
Message board for the users of flat assembler.
![]() |
Author |
|
vid 14 Sep 2005, 19:17
db 0EBh
|
|||
![]() |
|
forsaken 10 Oct 2005, 07:33
you could use IsDebuggerPresent, FindWindow & CreateFile to detect the common debuggers. SI with createFile.
|
|||
![]() |
|
LocoDelAssembly 10 Oct 2005, 13:26
forsaken, I'm interested in how you detect a debugger through FindWindow & CreateFile. What do you do to detect a debugger with those functions?
Regards |
|||
![]() |
|
forsaken 10 Oct 2005, 15:53
you can detect SoftICE with CreateFile, i cannot recall the filename which needs to be created in order to detect it but i do know that there's tons of information about SI detection so snoop around at google and im sure you will find more then enough info about the subject.
and as far as findWindow goes, this can be used to detect debuggers by class or window name, i do not think theres any way to detect a random debugger this way(?) well, anyways... check out IsDebuggerPresent and some of the SI detection tricks. |
|||
![]() |
|
shism2 10 Oct 2005, 22:48
There is a way to detect a random bugger. I just came up with it.. right now
Make a thread which detects the foreground window. GetForeGroundWindow If your in a debugger... such as Ollydbg or whatnot. Once your window is initlized. Check foreground window . After compare the text to your programs text.... If it's not the same your program is running another program.... ;0.. |
|||
![]() |
|
LocoDelAssembly 10 Oct 2005, 23:58
Ok, thanks to both for the data!!
|
|||
![]() |
|
r22 11 Oct 2005, 01:42
On program start.
-Have it create a remote thread (in like explorer). -The remote thread will load the program again (but suspended) -Patch the memory of the suspended program to JMP over the RemoteThread stuff. -Terminate teh first instance of the program -The new instanceof the Program (not loaded by the debugger) It seems like it would work :\ |
|||
![]() |
|
okasvi 11 Oct 2005, 03:21
r22, nice one
![]() ![]() _________________ When We Ride On Our Enemies support reverse smileys |: |
|||
![]() |
|
r22 11 Oct 2005, 04:43
just hit me, that patching a programs code section wouldn't be easy remotely while the process is suspended, so instead...
Just have the program check the command line that Created it and add an arguement if you want the program to skip its anti-debugger startup code. |
|||
![]() |
|
shism2 11 Oct 2005, 05:38
You can also use suspend process after the debugger has been found
![]() |
|||
![]() |
|
< Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2023, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.
Website powered by rwasa.