First, sorry for my bad english.
I'm trying to make VMProtect unpacker with unicorn emulator, but one of my sample shows me like this anti-debugging message:
WTSSendMessageW: "A debugger has been found running in your systeam. Please, unload it from memory and restart your program"
My sample is x86 pe dll and i don't know exact VMProtect version (but above 3.0 is definitely) In unpack process, WinAPI calling sequence looks like below:
IsWow64Process IsDebuggerPresent (make return 0) CheckRemoteDebuggerPresent (make pbDebuggerPresent as 0) NtQueryInformationProcess (make ProcessInformation as 0, return STATUS_PROT_NOT_SET) NtSetInformationThread NtQuerySystemInformation (3 times, maybe this is kernel anti-debugging routines) GetModuleFileNameW NtOpenFile (for file corruption check?) NtCreateSection NtMapViewOfSection NtUnmapViewOfSection NtClose NtProtectVirtualMemory // I think below code is detection routine GetModuleFileNameW GetProcessWindowStation GetUserObjectInformation LoadLibraryA (wtsapi32.dll) WTSSendMessageW (Anti-debugging detection message)
I think every detection routine has called before NtProtectVirtualMemory, and the rest of code is unpack their's code to text section with several NtProtectVirtualMemory functions. But, after the first NtProtectVirtualMemory has called, and samples shows detection routine without any suspicious WinAPI calling.
I have issue with unicorn emulator hook code, so i cannot logged all unpacking code, and when i running this sample with x86dbg, i cannot make same situation that i face on.
So, I wonder is there any anti-debugging technique which is not based on WinAPI? (single-step exception not occured yet, when detection timing)
I hope for your guide. thank you.