pasha
March 23rd, 2003, 03:28
greetz
first of all my apologies to be starting another thread under the same heading. as much as i hate to do this, i wanted to know some info on int 1 detection from the gurus.
as i read from the previous posts on the same heading. there are 3 ways to detect NTICE using int 1
1) Check if INT1 is trap gate - if so NTICE installed
2) CHECK exception code of INT1 - C0000005 if NTICE installed
3) EIP+2 - INT1 DPL=3 then NTICE installed
okay, now my question is how do i change the exception code so that the (2) method is defeated. do i need to hook KiUserExceptionDispatcher ??? or is there an easy way out ?
awaiting a reply...
best regards
pasha
first of all my apologies to be starting another thread under the same heading. as much as i hate to do this, i wanted to know some info on int 1 detection from the gurus.
as i read from the previous posts on the same heading. there are 3 ways to detect NTICE using int 1
1) Check if INT1 is trap gate - if so NTICE installed
2) CHECK exception code of INT1 - C0000005 if NTICE installed
3) EIP+2 - INT1 DPL=3 then NTICE installed
okay, now my question is how do i change the exception code so that the (2) method is defeated. do i need to hook KiUserExceptionDispatcher ??? or is there an easy way out ?
awaiting a reply...
best regards
pasha