![]() |
|
|
|
#1
|
||||
|
||||
|
Quote:
*isdebugpresent can detect unknow debuggers. *comparing firsts bytes of API funcs with CC can detect an unknow debugger. *setting SetUnhandledExceptionFilter, if you are under a unknow debugger, you can detect it. *Reading the trap bit ( four debug registers DR0,DR1,DR2,DR3 ). *if the unknow debugger uses total api redirection you can compare func address with image base. *in win9x reading the IDT or with VWIN32_Int41Dispatch. etc... Regards |
![]() |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| How to defeat Enigma protector External Files Checkup? | benney | General Discussion | 1 | 08-20-2016 02:13 |
| Help for unknown protector | Newbie_Cracker | General Discussion | 9 | 01-11-2011 17:42 |
| New or Unknown Protector | lordnasty | General Discussion | 0 | 06-19-2006 16:57 |
| Good Protection (Password Reminder) | anorganix | General Discussion | 6 | 11-22-2005 04:42 |