Does anti-debugger work for injected dlls?

Issues related to VMProtect
Post Reply
lsxuyimin
Posts: 4
Joined: Sun May 26, 2024 8:41 am

Does anti-debugger work for injected dlls?

Post by lsxuyimin »

I tested today,
1. protect a.dll, get a.vmp.dll, with anti-debugger enabled
2. inject a.vmp.dll into another process B, with CreateRemoteThread(...,&LoadLibrary,...), injection succeed and injected code worked good
3. in visual studio - Debug - attach to process B, everything in debug window looks good and process B do not exit or show a dialog says debugger detected.

Is this a expected behavior?
Immortale
Posts: 1
Joined: Mon Jan 15, 2024 10:07 am

Re: Does anti-debugger work for injected dlls?

Post by Immortale »

VMProtect detects the debugger only at the beginning of the program execution. To detect a debugger during the execution of the program, you need to manually call the VMProtectIsDebuggerPresent function.
lsxuyimin
Posts: 4
Joined: Sun May 26, 2024 8:41 am

Re: Does anti-debugger work for injected dlls?

Post by lsxuyimin »

Immortale wrote: Thu Jul 04, 2024 10:42 am VMProtect detects the debugger only at the beginning of the program execution. To detect a debugger during the execution of the program, you need to manually call the VMProtectIsDebuggerPresent function.
Thank you!
Post Reply