7

VMProtect uses a few anti-debug techniques. Firstly, you aren't going to want to tackle them on your own because there is quite and exhaustive set of techniques to detect a debugger. Consider using an anti-anti-debug plugin (ScyllaHide) One you are probably going to encounter that is difficult to work around is the rdtsc instruction. rdtsc essentially ...


1

Unfortunately there's no easy answer here. Most of these tools employ different types of heuristics to determine the version used. Often times just applying binary signatures which could be inaccurate. Without gaining a decent understanding of VMProtect to recognize the differences this will be quite difficult. If tools used are open-source or well-...


1

You can use something like ScyllaHide to hide your debugger while you still don‘t know the method they use to detect you.


1

If there's no way to debug it, use system mechanisms to load your DLL into protected process, then do whatever you like.


1

StrongOD can have unexpected behaviour if you are using Win7 as your debugging environment. Try to use ScyllaHide plugin with the VMProtect profile on, ignore Invalid or privileged instruction exception in the debugging options.


Only top voted, non community-wiki answers of a minimum length are eligible