New Protector

Ugh...


Found SoftICE detector quite easily, just NtQuerySystemInformation with NTice.sys, easy to get around..

I'm still having trouble finding normal debugger detector. I know it called GetProcessTimes() twice, and if the times are zero, or they don't match it says "Debugger detected" - to elimiinate tracing not doubt. But even so only called GetProcessTimes() once when I debug with Olly, and then Exit MessageBox.

Thought it was calling ZwQueryInformationProcess, but doesn't look like it now after all (calling with ProcessDebugPort). API only gets called twice, once from GetprocessTimes (argument is 4, which is processtime), and another from windows DLL itself (argument is 26, ProcessWow64Environment, which is always zero). Never called with argument 7 (ProcessDebugPort). And of course I"ve already "edited" the bytes at fs:[30] away to eliminate PEB debug detection.

Any hints? Maybe a way to detect that I haven't heard of yet?

-Lunar