Quote:
|
Originally Posted by newbie_cracker
[CODE]
Code:
004FBB7A 8038 CC CMP BYTE PTR DS:[EAX],0CC
004FBB7D 74 0A JE SHORT PASSWORD.004FBB89
|
This code "maybe" a BP detection because CC is the opcode of INT 3.
Quote:
|
Originally Posted by newbie_cracker
Is there a fixed address in memory which used by OllyDbg for storing breakpoint addresses? How SDProtector detects them?
|
AFAIK when you set a BP, Olly puts a CC to use its handler, so I think no memory is used to store it, only wait until INT 3.
If you're talking about Hardware BP, I think Olly stores its addresses in a local var, so no fixed address...Ummh!! I know that Registers DR0-DR3 are for debug breakpoints and curiously Olly only can set 4 Hardware BP
.
The protection can read and compare this registers.
Maybe that uses a code-execute time detection too.
Regards