Page 1 of 1

Debugger protection, boxedappsdk virtual process

Posted: Fri Oct 22, 2010 12:02 pm
by gkoukou
Hi again,

Since I show in the email I received when I bought the product that you are promoting boxedappsdk you might be interested for this.

debugger protection is not working in a process created out of a virtual file created by boxedappsdk.

I attached vs2005 to the process with no problem at all. Also IsDebuggerRunning() returns FALSE.

I could use some tip on howm to correct this behavior

Regards,

George

Re: Debugger protection, boxedappsdk virtual process

Posted: Wed Oct 27, 2010 2:49 pm
by gkoukou
Hi guys,

Is anybody going to look into this?

Re: Debugger protection, boxedappsdk virtual process

Posted: Wed Oct 27, 2010 3:23 pm
by Support
gkoukou wrote:Is anybody going to look into this?
I am :)
Sorry for the delay. Am I right that you bundled the protected file and the debugger detection doesn't work in that bundled file when it is being executed?

Re: Debugger protection, boxedappsdk virtual process

Posted: Thu Oct 28, 2010 9:00 am
by gkoukou
Not exactly but kind of

First I use vmprotect to protect a process

Then I include the protected process as a resource in another process

At runtime the "father" process loads the protected processes's data from resources and creates a virtual file using boxedappsdk. It then executes this virtual file (by calling createprocess API). The child process runs ok

If I attach vs2005 debugger to this child process the debugger attaches ok and the child process does not terminate with the specified message as it should.

Re: Debugger protection, boxedappsdk virtual process

Posted: Sat Nov 06, 2010 4:49 pm
by gkoukou
any news?

Re: Debugger protection, boxedappsdk virtual process

Posted: Sun Nov 07, 2010 6:01 am
by Admin
We plan to improve the anti-attach tricks in next versions of VMProtect.

Re: Debugger protection, boxedappsdk virtual process

Posted: Thu Nov 25, 2010 10:23 pm
by gkoukou
Ok I guess I will have to wait until the next release

Thanks