SunBeam wrote: ↑Mon Mar 18, 2019 6:08 pm
I think you can also do this in Lua
Try it and report.
EDIT: Yeah, may only prevent reading; not debugging
->
[Link]
Yeah doesn't work haha. i was wondering what it even does.
Code: Select all
mov rax,gs:[00000060]
movzx eax,byte ptr [rax+02] // RAX = PEB, Value of PEB+02 gets moved into EAX and then gets checked a few times in SystemModules and in the Game itself.
ret
i tried before xor eax,eax
But this is just forcing the return value of EAX to 0, the PEB+2 Flag still stays on 1.
the anti-debug is checking the PEB directly aswell
This is also the Reason, why CE's "Try to prevent detection of the debugger" option fails. It Patches just the value of EAX
This is how i"IsDebuggerPresent" API looks like after attaching CE's debugger, with enabled "prevent detection of the debugger" Option.
CE should Patch
KERNELBASE.IsDebuggerPresent+9 to
C6 40 02 00 C3 instead of
KERNEL32.IsDebuggerPresent and
31 C0 C3
the shortest way should be doing it like this. Funny is, this script should be work for any X64 Game/Application
Code: Select all
aobscanmodule(_Bypass,KERNELBASE.dll,0F B6 40 02 C3)
registersymbol(_Bypass)
_Bypass:
db C6 40 02 00 C3
[DISABLE]
unregistersymbol(_Bypass)
_Bypass:
db 0F B6 40 02 C3