View Single Post
  #14  
Old 10-13-2013, 03:55
ferrit.rce's Avatar
ferrit.rce ferrit.rce is offline
VIP
 
Join Date: Sep 2013
Location: Switzerland
Posts: 42
Rept. Given: 10
Rept. Rcvd 101 Times in 23 Posts
Thanks Given: 0
Thanks Rcvd at 5 Times in 4 Posts
ferrit.rce Reputation: 100-199 ferrit.rce Reputation: 100-199
I've just tried the binary and it's running without getting detected. You need the following protections:
- IsDebuggerPresent
- CheckRemoteDebuggerPresent
- CloseHandle
- ProcessDebugFlags
- NtSetContextThread
- Caption Change
Please check that no other debugger is installed, and the only plugin is OllyExt. Some plugins are interfering with my one.

Quote:
Originally Posted by sendersu View Post
Regarding hiding from VMProtect
whats is the set of options need to be used?
here is a sample app protected nicely by vmp and I fail to get the correct set of options on OllyExt using 2.01 release of Olly
it is either file corrupted or debugger detected
http://www.sendspace.com/file/cdq1ga

thanks
Reply With Quote