|
IsDebuggerPresent
77E72740 64A118000000 mov eax, dword ptr fs:[00000018]
77E72746 8B4030 mov eax, dword ptr [eax+30]
77E72749 0FB640002 movzx eax, byte ptr [eax+02]
77E7274D C3 ret
In the memory dump window, edit (eax+2] , it's ADD 7FFDF002 and change his value from 1 to 0 !
|