I have a PE file with section vmp0 vmp1, possible protected with VMProtect. I am using local debugger in IDA pro, the program will detect the debugger and pop-up an message box and quit , I used the break point on user32.MessageBoxW, the debugger will break, but I have hard time to find out which part of the disassembly code calling the function , would you please help me so that I can bypass what ever the program is checking.? I am struggling for a while.

  • At the beginning I can get the program running by bypassing isdebuggerpresent twice , but some how after working for a while the IDA can only break in the isdebuggerpresent once, the program can run in debugger within a virtual machine after I permanently patched kernel32 Feb 11 '20 at 23:08
  • Use ScyllaHide with x64dbg.
    – mrexodia
    Feb 14 '20 at 8:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.