i'm trying to fake the test ( dongle exist ) but one problem that i encounter is that the application detect it before i start debugging it .

this is what happen with more details : open( not attaching) the target programme in x64dbg before anything ( what i mean is that the debugger still loading moduals and ...) a pop-up show up with an message "you need the dongle usb key " aftre that message the debugger disassembly panel show up with eip at the kernel address of nt dll

my questions:

  1. is this is a type of anti-Reverse Engineering?
  2. how i bypass this type of protection ( if it is a protection ) ?

my working env:

  1. x64dbg

  2. win 7 64bit

  • did u try : hiding debugger
    – zerocool
    Dec 25, 2018 at 21:21
  • yes but it's not working
    – kc.wang
    Dec 25, 2018 at 21:21

1 Answer 1


It could be a TLS callback. Some debuggers have an option to break earlier. I suggest you use procmon to see who and when an handle is opened for your USB dongle.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.