8

This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location. ImageBase: The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, ...


1

When in ida you use patch byte, patch word, or assemble, the patch is NOT applied to the base executable. You just have to go to Edit-> Patch program -> Apply patches to input file. Then your input file is modified now.


1

Similar to those 2 APIs, there are similar ways to check about the presence of debugger. For instance: Checking CPU Ticking Time it takes to complete a preknown action switching from 64 to 32 and vice versa if supported (WOW) Loaded libraries(similar to ASLR bypassing) that might indicate the presence of a debugger or some sort of VM Specific attacks to ...


1

They aren't any, do no try to do the mathematically impossible. For now, all the techniques I found on Internet were easily worked around as soon as the anti-debug technique has been understood. So, I wonder if there are stronger ones. Yes, because there is no way of detecting a debugger that can not be faked. Software can not detect if it runs in a ...


Only top voted, non community-wiki answers of a minimum length are eligible