View Single Post
  #11  
Old 05-04-2005, 22:36
JuneMouse
 
Posts: n/a
TQN
i havent used hideDebugger Plugin i once tried it on xp having seen in ollydbg forum (a link to wasm..ru) it did not work then (some initialization problems
error code 1) after that i never tried it but at that time i saw it was using WaitForDebugEvent and ContinueDebug event which means it kinda runs a debugger within debugger

try loading ollydbg on ollydbg and open some xyz debuggee on child ollydbg and locate this hidedebugger on parent ollydbg view names and put a bp on
wait for debug event
then start single stepping on the xyz you will see the parent ollydbg break for every step kinda slows down run traces appreciably on some big projects no offence its kinda slow so i never tried to use it again and also
i use w2k mostly

anyway as to the problem in hand a dbgprint is passed out to a debugger
so the function naturally checks for is debugger present and if you puportedly decieve the actual status that check also fails and it doesnt pass out the debug string its not a problem of hidedebugger plugin
or svs isdebuggerpresent plugin or any other feature plugins that may decieve isDebuggerPresent api
so if you want to recieve out put you should not hide your debugger

its like the game rootkits play to defeat sysinternals ,f-secures, blah blah revealers they were checking for hidden process and these were
not hiding to them but hiding to every other thing

bythe way if there is no debugger the system still sends the debug out put to dbgservice using int 2d functionality look at sysinternals debug view or osronlines debugmon they kinda hook int 2d to get all those debug out put generates
there are some environment variable like _NT_DEBUG_BLAH_BLAH
and such along with kdbgctrl.exts !dbgprint in windbg which uses these
functionalities

so have fun poking around

and as far as tls is concerned yes there are certain factors like dynamic loading of dlls also cannot use tls w9x loader ignores it etc etc
but is any one still using 286 and wordstar and lotus ??

Last edited by JuneMouse; 05-04-2005 at 22:59.
Reply With Quote