[C++] Simple Anti-Debug trick
1 Attachment(s)
Hello guys
I was working with ThunderSoft DRM a few days ago. The interesting thing I found was a simple debugger identification technique (Not Directly) that I decided to implement in C++ programming language after analysis. These steps are : 1- GetCommandLine (Retrieves the command-line) 2- Clean the GetCommandLine output 3- Pass the output to lpFileName in CreateFile 4- Use OPEN_EXISTING flag in dwCreationDisposition So, if process was open in debugger, the handle of CreateFile is -1. |
In my system don't works.. I can't see attach, and re-write code:
Code:
call GetCommandLineA But - if I remove quotes (insert after getcommandline call) Code:
mov ebx,eax ;save ptr cmdline x64dbg, win10. |
All times are GMT +8. The time now is 18:23. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX