Page 1 of 1

Does anti-debugger work for injected dlls?

Posted: Wed Jul 03, 2024 4:16 pm
by lsxuyimin
I tested today,
1. protect a.dll, get a.vmp.dll, with anti-debugger enabled
2. inject a.vmp.dll into another process B, with CreateRemoteThread(...,&LoadLibrary,...), injection succeed and injected code worked good
3. in visual studio - Debug - attach to process B, everything in debug window looks good and process B do not exit or show a dialog says debugger detected.

Is this a expected behavior?

Re: Does anti-debugger work for injected dlls?

Posted: Thu Jul 04, 2024 10:42 am
by Immortale
VMProtect detects the debugger only at the beginning of the program execution. To detect a debugger during the execution of the program, you need to manually call the VMProtectIsDebuggerPresent function.

Re: Does anti-debugger work for injected dlls?

Posted: Sat Jul 06, 2024 6:32 am
by lsxuyimin
Immortale wrote: Thu Jul 04, 2024 10:42 am VMProtect detects the debugger only at the beginning of the program execution. To detect a debugger during the execution of the program, you need to manually call the VMProtectIsDebuggerPresent function.
Thank you!