Skip to content

nicelnicel/XAntiDebug

 
 

Repository files navigation

VMProtect 3.x Anti-debug Method Improved

Quick summary:

  • IsDebuggerPresent
  • CheckRemoteDebuggerPresent
  • CloseHandle(0xDEADC0DE)
  • ZwQueryInformationProcess(ProcessDebugObjectHandle), called correctly
  • crc32 check on direct syscall
  • ZwQueryInformationProcess(ProcessDebugObjectHandle), called with ReturnLength == ProcessInformationClass

About

VMProtect 3.x Anti-debug Method Improved

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • C++ 98.8%
  • C 1.2%