Exetools  

Go Back   Exetools > General > General Discussion
Reload this Page DVRStudioPro terminate Olly maybe a new asprotec version
Register Forum Rules FAQ Calendar Mark Forums Read

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 02-21-2005, 04:06
the_beginner the_beginner is offline
Friend
  
Join Date: Feb 2004
Location: Germany
Posts: 85
Rept. Given: 114
Rept. Rcvd 13 Times in 7 Posts
Thanks Given: 97
Thanks Rcvd at 16 Times in 9 Posts
the_beginner Reputation: 13
thanks ,I cant run :-( on olly ,but driverstudio 2.6 with iceext run perfect
Reply With Quote
  #2  
Old 02-21-2005, 04:33
dyn!o's Avatar
dyn!o dyn!o is offline
Friend
  
Join Date: Nov 2003
Location: Own mind
Posts: 214
Rept. Given: 1
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 8
Thanks Rcvd at 0 Times in 0 Posts
dyn!o Reputation: 1
Check if it uses NtQueryInformationProcess or ZwYieldExecution APIs. Olly and other ring3 debuggers can be easily detected by using any of them.

Good luck.
Reply With Quote
  #3  
Old 02-21-2005, 07:17
mc707
 
Posts: n/a
Quote:
Originally Posted by dyn!o
ZwYieldExecution
It is known how NtQueryInformationProcess used against ring3 debugger. But how about ZwYieldExecution ? How can it help to catch debugger?
Last edited by mc707; 02-21-2005 at 07:21.
Reply With Quote
Reply

« Previous Thread | Next Thread »
Thread Tools
Display Modes
Hybrid Mode Hybrid Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Inline patch or loader for Asprotec 1,24-1.3???? the_beginner General Discussion 22 12-31-2004 02:19
is this possible to vonvert VS .NET DVD Version to CD Version? NoneForce General Discussion 1 03-13-2004 11:51


All times are GMT +8. The time now is 07:37.

Aaron's homepage - Top

Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )