dongle check happen before a debugger start debugging

Question

i'm trying to fake the test ( dongle exist ) but one problem that i encounter is that the application detect it before i start debugging it .

this is what happen with more details : open( not attaching) the target programme in x64dbg before anything ( what i mean is that the debugger still loading moduals and ...) a pop-up show up with an message "you need the dongle usb key " aftre that message the debugger disassembly panel show up with eip at the kernel address of nt dll

my questions:

1. is this is a type of anti-Reverse Engineering?
2. how i bypass this type of protection ( if it is a protection ) ?

my working env:

1. x64dbg

2. win 7 64bit

Answer 1

It could be a TLS callback. Some debuggers have an option to break earlier. I suggest you use procmon to see who and when an handle is opened for your USB dongle.