IDA: Attach to Process -> Menu deactivated [Archive]

View Full Version : IDA: Attach to Process -> Menu deactivated

Drigo

May 13th, 2009, 05:26

Hey Guys

I have a harcore protected APP. When i attach to process a menuitem will be deactivated. I use IDAStealth, but when I am activate the Option "Disable NTTerminateTread,..." the App crash.

Somebody known keywords to find the Memcheck??
I seems to be, that the APP known, if a Debugger inject a DLL. How the APP will check this? Get Tickcount is also activated by IdaStealth.

Thanks for your anwers.

Externalist

May 14th, 2009, 00:31

Search in google for "anti attach debugger". I remember there were about 2 methods over at OpenRCE, and a couple more at nezumi's blog. nezumi's blog is :

Code:

http://nezumi-lab.org/