Unseen Debugger Detection (Ollydbg)

		Exetools > General > General Discussion
Unseen Debugger Detection (Ollydbg)

09-26-2005, 21:06

Shub-Nigurrath Shub-Nigurrath is offline

VIP

Join Date: Mar 2004

Location: Obscure Kadath

Posts: 971

Rept. Given: 70

Rept. Rcvd 431 Times in 101 Posts

Thanks Given: 83

Thanks Rcvd at 405 Times in 127 Posts

I tried to write a debugger loader (createprocess in debug mode) which calls the ZwSetInformationObject just after having se to 0 those two values, just before resuming detect.exe, and I still get the detection message..

humm interesting..

__________________
Ŝħůb-Ňìĝùŕřaŧħ ₪)
There are only 10 types of people in the world: Those who understand binary, and those who don't
http://www.accessroot.com

Last edited by Shub-Nigurrath; 09-26-2005 at 21:38.

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
New OllyDbg detection by Armadillo?	Maltese	General Discussion	1	07-05-2005 11:14
Another way to detect OllyDbg and another debugger	TQN	General Discussion	2	08-03-2004 09:12

All times are GMT +8. The time now is 03:00.