![]() |
|
#11
|
|||
|
|||
|
TQN
i havent used hideDebugger Plugin i once tried it on xp having seen in ollydbg forum (a link to wasm..ru) it did not work then (some initialization problems error code 1) after that i never tried it but at that time i saw it was using WaitForDebugEvent and ContinueDebug event which means it kinda runs a debugger within debugger ![]() try loading ollydbg on ollydbg and open some xyz debuggee on child ollydbg and locate this hidedebugger on parent ollydbg view names and put a bp on wait for debug event then start single stepping on the xyz you will see the parent ollydbg break for every step kinda slows down run traces appreciably on some big projects no offence its kinda slow so i never tried to use it again and also i use w2k mostly anyway as to the problem in hand a dbgprint is passed out to a debugger ![]() so the function naturally checks for is debugger present and if you puportedly decieve the actual status that check also fails and it doesnt pass out the debug string its not a problem of hidedebugger plugin or svs isdebuggerpresent plugin or any other feature plugins that may decieve isDebuggerPresent api so if you want to recieve out put you should not hide your debugger ![]() its like the game rootkits play to defeat sysinternals ,f-secures, blah blah revealers they were checking for hidden process and these were not hiding to them but hiding to every other thing bythe way if there is no debugger the system still sends the debug out put to dbgservice using int 2d functionality look at sysinternals debug view or osronlines debugmon they kinda hook int 2d to get all those debug out put generates ![]() there are some environment variable like _NT_DEBUG_BLAH_BLAH and such along with kdbgctrl.exts !dbgprint in windbg which uses these functionalities so have fun poking around ![]() and as far as tls is concerned yes there are certain factors like dynamic loading of dlls also cannot use tls w9x loader ignores it etc etc but is any one still using 286 and wordstar and lotus ?? Last edited by JuneMouse; 05-04-2005 at 22:59. |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| struct as local var in ida | upb | General Discussion | 3 | 03-03-2005 17:29 |
| Olly thread patching... help | SvensK | General Discussion | 5 | 10-11-2003 11:52 |