![]() |
|
#4
|
|||
|
|||
|
Yes, obsiduim has a custom way to detect hwbp. If I remember well, It sets the hwbp to some specific location in the code to trigger the seh and the seh will set some values in memory.
after returning from the seh, those values will be tested to detect if hwbps were modified. if you want to get near oep on 4.x targets, you can use this script. It worked on many targets but I don't guarantee that it will work always. Use a hidden olly.No hwbp and start it from entrypoint. Last edited by mm10121991; 10-12-2014 at 08:23. |
| The Following User Gave Reputation+1 to mm10121991 For This Useful Post: | ||
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Adobe protection scheme | Dark Intentions | General Discussion | 0 | 07-09-2015 03:35 |
| Request for a good protection scheme in Java | DaGoN | General Discussion | 7 | 02-20-2014 04:42 |