I have a PE file with section vmp0 vmp1, possible protected with VMProtect. I am using local debugger in IDA pro, the program will detect the debugger and pop-up an message box and quit , I used the break point on user32.MessageBoxW, the debugger will break, but I have hard time to find out which part of the disassembly code calling the function , would you please help me so that I can bypass what ever the program is checking.? I am struggling for a while.
2
-
At the beginning I can get the program running by bypassing isdebuggerpresent twice , but some how after working for a while the IDA can only break in the isdebuggerpresent once, the program can run in debugger within a virtual machine after I permanently patched kernel32– Silicon CreatureCommented Feb 11, 2020 at 23:08
-
Use ScyllaHide with x64dbg.– mrexodiaCommented Feb 14, 2020 at 8:43
Add a comment
|