2

I am trying to disassemble an online game Client to get something , There is LoadlibraryA() function that call dll file , But that dll file is protected somehow so it show a message that there is a debugger injected in the program and close the Client (Message appear too when trying to use this function and dll in VS C# program debug mode) , So is there any way to try to trace the Client without this message like a stealth program or something like that?

1

I think you can try use a special plugins for IDA which hide debugger from detect.

ScyllaHide

TitanHide (driver)

| improve this answer | |
  • Not working give me same message or maybe I am doing something wrong , Do you have tutorials? – Tarek Ibrahem Sep 10 '14 at 10:14
  • I try ScyllaHide copy all files in plugins in IDA -> Plugins and start IDA then try to analyze get same msg I am trying to trace SRO_Client Hackshield maybe "ehsvc.dll" need another stealth program? – Tarek Ibrahem Sep 10 '14 at 13:11
  • Do you sure what ScyllaHide load? Did you look ScyllaHide banner in "Output window" when plugin load? Try copy scylla_hide.ini and NtApiCollection.ini in IDA plugin dir too.Check plugin - pres Alt-X and play with configs. – DOD Sep 11 '14 at 6:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.