Jump to content
Tuts 4 You

I want to write a anti-anti debugging pluging.


r42fr

Recommended Posts

Insid3Code

It is hard to cover all existing anti-debug,  I advise you to begin with very basic detection tricks like hiding the PEB and memory patching of known API like FindWindow and other.

Link to comment
Insid3Code

I guess, you mean debuggee?
If you plan de code your plugin for OllyDbg you must read the PDK available on author website.To read/write into debuggee memory you can use ODBG2_Pluginnotify to get (debuggee Process ID)  when PN_NEWPROC == parm1

Edited by Insid3Code
Link to comment
Insid3Code

All you want is available into OllyDbg PDK, please read it!
hxxp://www.ollydbg.de/version2.htmlAlso, take a deep look into traceapi source for undocumented functions.

Edited by Insid3Code
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...