I am trying to disassemble an online game Client to get something , There is LoadlibraryA() function that call dll file , But that dll file is protected somehow so it show a message that there is a debugger injected in the program and close the Client (Message appear too when trying to use this function and dll in VS C# program debug mode) , So is there any way to try to trace the Client without this message like a stealth program or something like that?
2
-
1possible duplicate of Anti-debug techniques for MS-Windows?– Jason GeffnerSep 9, 2014 at 21:35
-
what protection is it using? (as that information is kinda critical)– evlncrn8Sep 10, 2014 at 18:29
Add a comment
|
1 Answer
I think you can try use a special plugins for IDA which hide debugger from detect.
TitanHide (driver)
-
Not working give me same message or maybe I am doing something wrong , Do you have tutorials? Sep 10, 2014 at 10:14
-
I try ScyllaHide copy all files in plugins in IDA -> Plugins and start IDA then try to analyze get same msg I am trying to trace SRO_Client Hackshield maybe "ehsvc.dll" need another stealth program? Sep 10, 2014 at 13:11
-
Do you sure what ScyllaHide load? Did you look ScyllaHide banner in "Output window" when plugin load? Try copy
scylla_hide.iniandNtApiCollection.iniin IDA plugin dir too.Check plugin - pres Alt-X and play with configs.– DODSep 11, 2014 at 6:18