Unseen Debugger Detection (Ollydbg)

[Shub-Nigurrath]

to me it doesn't crash, Olly it's still alive after debugging of this..

Taos, what exactly is the difference between system and process debugger (as shown in your example?) I dont have SI installed to test but is that what it's referring to?

Shub: I think he was referring to his version that crashes in olly. Although when I run it, it detects a process debugger (same w/ msvs it detects process debugger). I think by crash he means it keeps running and doesn't stop. But it's definitately detected.

very interesting pan

[taos]

Originally Posted by Shub-Nigurrath

to me it doesn't crash, Olly it's still alive after debugging of this..

Yeah, but can you restart app? can you terminate app inside Olly?
can you pause and continue?. You can not use Olly to debug another app, you must exit.
App crash when you run it with Olly too.

Originally Posted by Viasek

what exactly is the difference between system and process debugger (as shown in your example?)

System debugger is a SO internal installed debug (it runs at boot), like WinDbg from M$. Procees debugger is like Olly.