Log in

View Full Version : getright5.1 beta2 detect debugger


Timbo
February 13th, 2004, 10:04
seems that the new version is pain for me,
couldn't find out how new arma detect the debugger !
i have hidden all but it won't start.

anyone knows why ?

SpeKKeL
February 13th, 2004, 13:17
You didn't hide it enough....!

SpeKK.

evaluator
February 13th, 2004, 13:32
your post too much incomplete.
at least write your system, debugger, how you hide..

Timbo
February 13th, 2004, 13:59
i'm useing
ds2.7 (xp) with sten's iceext, patched int 68, patched keyboard
does the new getright scan the memory ?
does your's debugger the new 5.1b2 ?
work on w9x with debugger !

evaluator
February 13th, 2004, 14:55
yah, that can method of detecting ntice by RFlag.
You need patch ntice's INT0E handler. later..

evaluator
February 13th, 2004, 16:01
at start of ntice's INT0E handler you will meet instuction:
8164240CFFFFFEFF = AND dword[esp+0C],0FFFEFFFF

so try change byte FE to FF, which avoids RF removal.

maybe Sten soon will release newer version of his plugin, where..

Timbo
February 13th, 2004, 17:24
tried it (8164240CFFFFFEFF = AND dword[esp+0C],0FFFFFFFF)
doesn't seem to work

evaluator
February 13th, 2004, 18:38
sure in INT0E handler?
if so, maybe better rename-patch NTice manually;
or wait to new IseExt?

Timbo
February 14th, 2004, 05:22
Thanks evaluator

mmk
February 14th, 2004, 06:39
If you're using IceExt, Armadillo (I assume GetRight is packed with Armadillo) detects IceExt by checking this registry key: HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ IceExt.

evaluator
February 14th, 2004, 14:15
well Timbo,
but tell people, what you did, ye?

Timbo
February 14th, 2004, 16:25
Quote:
[Originally Posted by evaluator]well Timbo,
but tell people, what you did, ye?


Hmm blind on both eys didn't thought about Iseext
or didn't realisize first the Chester posting

ok hidden the Izipl(u)g or was it DsaPie ??

Are there any other VER$ of ntice build >1268 <1772 ??

Js
February 15th, 2004, 10:25
glad you cleared it up about that DsaPie, been bugging me for some time.