I'm debugging a software and it hits
access violation on
wcslen function under debugger but runs normally without it.
First I thought It had some anti-debug trick, but I could not found any indicators of that in the executable, I also could not found any anti-debug technique with
I've tried using both
windbgbut I had same problem on both of them. I also launched them with admin privileges since I thought privileges might be needed for something but error didn't go away.
Here is exact line of inside
wcslen which causes this:
mov cx, word ptr ds:[eax]
and the address which
eax points to is
EF415351 which is pretty big.
So my question is, is there any anti-debug technique which involves
access violation? How can I workaround this error?
Can I patch program so that it logs
wcslen arguments, and then I'll just compare it's argument under debugger and normal execution and maybe find something interesting.
P.S I also get same error when launching application under debugger, so attaching or running under it doesn't make any difference.