Log in

View Full Version : Anti-Smartchk? ImageHlp.dll... int3? what?


Manko
October 14th, 2002, 17:55
I don't get this.

I try and load a couple of programs and run them through smartcheck. Not VB. Just to see how much it reports and if and when it can be good to use anyway.

More than one app has presented me with the following situation.

It doesnt really report any events. the count is on maybe13, but nothing more happens except in the "loader" window it shows Imagehlp.dll being loaded and unloaded for eternity... Hmm...

I've changed the window name and id of smartchk.

Is this some normal anti-debug? Haven't done any studying on those yet. Don't find anything on the net, probably I'm just not finding the right words to search on...

Any ideas?

/Manko

Aimless
October 16th, 2002, 03:59
What you are probably encountering is a Smartcheck breaker executable. Just as Softice is easy to be detected, its also easy to detect Smartcheck.

In order to override these, you must first find out HOW smartcheck gets detected. Smartcheck generally runs itself and from within itself, runs the program to be monitored. This implies that the program can check for smartcheck executables, .SUP files and the like.

Try searching for "Ryan" minus the quotes and you will get an idea of the same (some smartcheck tips too...). If you write to him and are polite, maybe he will even tell you how to do it.

Have phun, always.