Cheat Engine :: View topic - Detecting a debugger in VB.Net

Cheat Engine
The Official Site of Cheat Engine

FAQ

Memberlist

Usergroups

Profile

Detecting a debugger in VB.Net

Cheat Engine Forum Index -> General programming

View previous topic :: View next topic

Author

Message

Jorg hi
I post too much

Reputation: 7

Joined: 24 Dec 2007
Posts: 2276
Location: Minnesota

Posted: Tue Apr 21, 2009 7:35 pm Post subject: Detecting a debugger in VB.Net

I am making a program but I want to have some sort of guard to block programs from debugging it, also if possible from reading memory. How would I do this? _________________ CEF will always stay alive.

dnsi0
I post too much

Reputation: 0

Joined: 04 Jan 2007
Posts: 2674

Posted: Tue Apr 21, 2009 7:42 pm Post subject: Re: Detecting a debugger in VB.Net

Cheat Engine wrote:

I am making a program but I want to have some sort of guard to block programs from debugging it, also if possible from reading memory. How would I do this?

Write your self a driver that hooks NtReadVirtualMemory, NtWriteVirtualMemory, NtSetContextThread, NtGetContextThread, NtOpenProcess, NtOpenThread, KeAttachProcess, KeStackAttachProcess.

Now get over to usermode and do debugger checks: http://www.codeproject.com/KB/security/AntiReverseEngineering.aspx

Thats a good guide. Now if you want, you can enum the processes and check for debug strings.

slippppppppp
Grandmaster Cheater

Reputation: 0

Joined: 08 Aug 2006
Posts: 929

Posted: Tue Apr 21, 2009 10:44 pm Post subject:

Code:

IsDebuggerPresent

dnsi0
I post too much

Reputation: 0

Joined: 04 Jan 2007
Posts: 2674

Posted: Wed Apr 22, 2009 5:11 pm Post subject:

slippppppppp wrote:

Code:

IsDebuggerPresent

That really is dumb. Look at ANY disassembler, you see the IsDebuggerPresent hook.

&Vage
Grandmaster Cheater Supreme

Reputation: 0

Joined: 25 Jul 2008
Posts: 1053

Posted: Wed Apr 22, 2009 7:14 pm Post subject:

dnsi0 wrote:

slippppppppp wrote:

Code:

IsDebuggerPresent

That really is dumb. Look at ANY disassembler, you see the IsDebuggerPresent hook.

What? .NET doesn't compile IsDebuggerPresent checks in it, only MSVC++ does.

Jorg hi
I post too much

Reputation: 7

Joined: 24 Dec 2007
Posts: 2276
Location: Minnesota

Posted: Wed Apr 22, 2009 7:19 pm Post subject:

I tried the "IsDebuggerPresent" & bypassed it in 4 minutes... I'll try the way you said dnsi0. Edit: I don't know C++ only VB. _________________ CEF will always stay alive.

dnsi0
I post too much

Reputation: 0

Joined: 04 Jan 2007
Posts: 2674

Posted: Wed Apr 22, 2009 7:29 pm Post subject:

Cheat Engine wrote:

I tried the "IsDebuggerPresent" & bypassed it in 4 minutes... I'll try the way you said dnsi0.

Edit:
I don't know C++ only VB.

Ok... If you don't know C++ or C then scratch the part about writing a kernel driver.

Jorg hi
I post too much

Reputation: 7

Joined: 24 Dec 2007
Posts: 2276
Location: Minnesota

Posted: Wed Apr 22, 2009 7:34 pm Post subject:

First I'm going to make a process & .dll Scanner like the ones Game Guards use first. _________________ CEF will always stay alive.

&Vage
Grandmaster Cheater Supreme

Reputation: 0

Joined: 25 Jul 2008
Posts: 1053

Posted: Wed Apr 22, 2009 7:57 pm Post subject:

dnsi0 wrote:

Cheat Engine wrote:

I tried the "IsDebuggerPresent" & bypassed it in 4 minutes... I'll try the way you said dnsi0.

Edit:
I don't know C++ only VB.

Ok... If you don't know C++ or C then scratch the part about writing a kernel driver.

What? You don't even need have to write a driver to have anti-debug <_<

NINTENDO
Grandmaster Cheater Supreme

Reputation: 0

Joined: 02 Nov 2007
Posts: 1371

Posted: Thu Apr 23, 2009 5:29 am Post subject:

dnsi0 wrote:

Cheat Engine wrote:

I tried the "IsDebuggerPresent" & bypassed it in 4 minutes... I'll try the way you said dnsi0.

Edit:
I don't know C++ only VB.

Ok... If you don't know C++ or C then scratch the part about writing a kernel driver.

Is it hard?
_________________

Intel over amd yes.

haha01haha01
Grandmaster Cheater Supreme

Reputation: 0

Joined: 15 Jun 2007
Posts: 1233
Location: http://www.SaviourFagFails.com/

Posted: Thu Apr 23, 2009 12:25 pm Post subject:

wallantia wrote:

dnsi0 wrote:

Cheat Engine wrote:

I tried the "IsDebuggerPresent" & bypassed it in 4 minutes... I'll try the way you said dnsi0.

Edit:
I don't know C++ only VB.

Ok... If you don't know C++ or C then scratch the part about writing a kernel driver.

Is it hard?

writing a kernel driver? very. and u get bsod'ed on every small mistake.

&Vage
Grandmaster Cheater Supreme

Reputation: 0

Joined: 25 Jul 2008
Posts: 1053

Posted: Thu Apr 23, 2009 3:22 pm Post subject:

You get BSOD'd if unhandled exceptions are thrown.

lurc
Grandmaster Cheater Supreme

Reputation: 2

Joined: 13 Nov 2006
Posts: 1900

Posted: Thu Apr 23, 2009 3:58 pm Post subject:

haha01haha01 wrote:

wallantia wrote:

dnsi0 wrote:

Cheat Engine wrote:

I tried the "IsDebuggerPresent" & bypassed it in 4 minutes... I'll try the way you said dnsi0.

Edit:
I don't know C++ only VB.

Ok... If you don't know C++ or C then scratch the part about writing a kernel driver.

Is it hard?

writing a kernel driver? very. and u get bsod'ed on every small mistake.

Of course you'll get BSOD. It's like playing around with your computers heart, so to speak, so even the smallest mistakes will cause failure.

Just make sure to __try/__except/__finally During procedures that may throw exceptions, and make sure to have plenty of error checks.

As long as you know what your doing (which you should if you plan on making a driver) you should be fine.
_________________

Display posts from previous:

	Cheat Engine Forum Index -> General programming	All times are GMT - 6 Hours
Page 1 of 1

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum