Pass Debugger Check in VMprotect 2.x

[mojtaba]

I'm dealing with an app which is protected whit VMProtect 2.x (Checked by DIE).

i checked some windows api like :

• CheckRemoteDebuggerPresent ()
• IsDebuggerPresent ()
• ...

and use some ollydbg plugins like:

• Olly Advanced
• Hide Debugger
• StrongOD

But it still get this error:

 

Here is my log data:log-MyApp.txt

what should i do to pass this error and open the app by debugger?

[CodeExplorer]

Did you tried this Olly modification:
https://forum.tuts4you.com/files/file/479-ollydbg-110-special-for-guru-lcf-ats-vmprotect-api-turbo-tracer-11-script/
 

Edited December 17, 2019 by CodeExplorer

[mojtaba]

@CodeExplorer

thanks, But it didn't help me and  i still have the debugger detection problem!

do you know any other solution?

Edited December 25, 2019 by mojtaba

[HostageOfCode]

If it's 64bit try sharpod if 32bit titanhide or scylla hide but titanhide hooks all the kernel checks.

[mojtaba]

On 12/25/2019 at 1:17 PM, HostageOfCode said:

If it's 64bit try sharpod if 32bit titanhide or scylla hide but titanhide hooks all the kernel checks.

hello 

I tried it, but i dont know if i used it in right way or not?! do i have to attach the app to debugger and then find the app's PID (i used this :

tasklist

in cmd ) and insert the PID into the gui and select the methods and hit the 'Hide' button.

but it still detect the debugger !!! :((

 

I tested the TitanHide test file and it works correctly. when i hided it, all of the flags turns 0.

but still it does'nt works on my app!

Edited January 16, 2020 by mojtaba

[HostageOfCode]