Debuggers Anti-Attaching Techniques - Part 3
In this post i will shed some light on another anti-attach trick. The point here is based on the fact that only one debugger is allowed to debug a specific process. Implementing it is as easy as creating two executables (hereafter, i will refer to them as EXE1 and EXE2). EXE1 spawns and then debugs EXE2. So, any further attempt to debug EXE2 will fail. A demonstrating example can be found here. Th
New OllyDbg Anti-Debug Trick
Actually, it is not just a trick. It is a buffer overflow in OllyDbg v1.10, which does not affect OllyDbg v2.0 since the compromised functionality seems to be dropped or subject to some enhancements. The story begins when i was trying to create the longest possible pathname for an Exe file to see if olly would crash upon loading that file. And olly really did. Loading olly into another instance of
Hyde OllyDbg2 plugin | BoB's place
#Hyde v1.01 Hyde is a plugin for OllyDbg v2.xx, it's purpose is to hide ollyDbg from detection by the debugee. This is done by patching memory and apis, and the options (or patch sets) can be saved to file, for easy reloading. For example, with an ASProtect target you can set the patches that you need for ASProtect and save to a file "ASProtect.SET". This patch-set file can then be loaded whenever
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
処理を実行中です
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Debuggers Anti-Attaching Techniques - Part 1
Anti-Dumping
