View Single Post
  #5  
Old 09-26-2005, 20:11
Opc0de
 
Posts: n/a
When you create/attach a program inside the debugger, the debug api will call a native function called "NtCreateDebugObject" that will create a DebugObject and set the EPROCESS->DebugPort = DebugObject.

SoftICE don't use the Debug API, that is the reason that this trick don't detect it.

Regards,
Opc0de
Reply With Quote