New answers tagged


The debugging API provides a notification for newly loaded libraries so the debugger can inspect their export table and set breakpoints on matching symbols.


If it's challenging or not depends entirely on what you do to make it challenging and the skill level of the attacker. For some it's already enough if you make the decompiler in some old leaked IDA version fail, others read the pure assembly and know exactly what's going on not needing the decompiler at all. The best way to prevent tampering is having ...

Top 50 recent answers are included