Posted May 18, 201312 yr I want to write a anti-anti debugging plugin.But I don't know how to go throw the code to find the traps?
May 18, 201312 yr It is hard to cover all existing anti-debug, I advise you to begin with very basic detection tricks like hiding the PEB and memory patching of known API like FindWindow and other.
May 19, 201312 yr I guess, you mean debuggee?If you plan de code your plugin for OllyDbg you must read the PDK available on author website.To read/write into debuggee memory you can use ODBG2_Pluginnotify to get (debuggee Process ID) when PN_NEWPROC == parm1 Edited May 19, 201312 yr by Insid3Code
May 19, 201312 yr All you want is available into OllyDbg PDK, please read it!hxxp://www.ollydbg.de/version2.htmlAlso, take a deep look into traceapi source for undocumented functions. Edited May 19, 201312 yr by Insid3Code
May 25, 201312 yr There're good tutorials on www.woodmann.com about anti-debugging. Follow that site!
Create an account or sign in to comment