This question already has an answer here:
- How to bypass ZwContinue? 2 answers
I'm having an issue when trying to patch an application. If I open the .exe application with x64dbg, it first goes through ntdll.dll and then runs the application module. It works fine as long as I don't "touch" the application module code. As soon as I apply any kind of patch, even something as simple as adding a "nop" instruction, I can no longer run the application (it terminates immediately).
When I try to debug, I notice that the execution doesn't even reach the application and stays within the ntdll.dll module. It loops 14 times between these 3 lines and the program terminates on the call to
00007FFA616C2FCE | B2 01 | mov dl,1 00007FFA616C2FD0 | 48:8BCB | mov rcx,rbx 00007FFA616C2FD3 | E8 28770200 | call <ntdll.NtContinue>
I've read that some anti-attach methods leverage the
NtContinue function but in my case it's not really an attachment problem since I can debug without any issue until I patch the application. If anything it is rather an anti-patching trick...
I was wondering if this was something known already, or if you had any leads that I could try to solve this issue. I have already tried installing the "ScyllaHide" plugin and ticked the option "NtContinue" but it doesn't change the behavior. Maybe there is another anti-anti-debug plugin I could use?