Unseen Debugger Detection (Ollydbg)

		Exetools > General > General Discussion
Unseen Debugger Detection (Ollydbg)

09-26-2005, 20:11

Opc0de

Posts: n/a

When you create/attach a program inside the debugger, the debug api will call a native function called "NtCreateDebugObject" that will create a DebugObject and set the EPROCESS->DebugPort = DebugObject.

SoftICE don't use the Debug API, that is the reason that this trick don't detect it.

Regards,
Opc0de

« Previous Thread | Next Thread »

Thread Tools
Show Printable Version Email this Page
Display Modes
Switch to Linear Mode Switch to Hybrid Mode Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
New OllyDbg detection by Armadillo?	Maltese	General Discussion	1	07-05-2005 11:14
Another way to detect OllyDbg and another debugger	TQN	General Discussion	2	08-03-2004 09:12

All times are GMT +8. The time now is 15:09.