Weird behavior in a patched program

		Exetools > General > General Discussion
Weird behavior in a patched program

02-22-2022, 02:12

Stingered

Banned User

Join Date: Dec 2017

Posts: 257

Rept. Given: 0

Rept. Rcvd 3 Times in 3 Posts

Thanks Given: 296

Thanks Rcvd at 181 Times in 90 Posts

Not sure I've heard of this one happening before.

1. Use ScyllaHide plugin to see if you can hide the debugger and check behavior.
2. Set debugger exception ignore range to: 00000000-99999999
3. Disable System BP and Entry BP to see if behavior changes inside debugger.
4. Create a loader to perform patch in-memory.

Research links:

https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software

https://anti-debug.checkpoint.com/

Last edited by Stingered; 02-22-2022 at 04:31.

The Following 2 Users Say Thank You to Stingered For This Useful Post:
Doit (02-23-2022), niculaita (02-22-2022)

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Evading behavior analysis	0xall0c	General Discussion	3	05-14-2018 23:44
armadillo strange behavior	drequinox	General Discussion	0	02-11-2006 08:52
weird search behavior	abitofboth	General Discussion	0	01-30-2005 20:48
A weird debugging question	sgdt	General Discussion	5	06-28-2004 13:11

All times are GMT +8. The time now is 05:37.