You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As the process should only arrange for an int 3 breakpoint execution (system breakpoint) only when it detects a debugger, with ScyllaHide active and working properly x32dbg shouldn't receive a system breakpoint event. However even with the plugin loaded and active x32dbg pauses at the system breakpoint which means the debugger is detected by the process somehow.
Possible causes:
If the debugger check is done via checking isDebuggerPresent boolean value in PEB, the following screenshot in ScyllaHide source code shows at the create process event the execution never reaches the PEB patch due to specialPEBFix being initialized to false:
However when the debugger pauses at the breakpoint checking the IsDebuggerPresent value shows it to be false. Which means something after the create process event is indeed patching the PEB properly but not quick enough for it to go completely undetected by the ntdll loader:
The text was updated successfully, but these errors were encountered:
As the process should only arrange for an int 3 breakpoint execution (system breakpoint) only when it detects a debugger, with ScyllaHide active and working properly x32dbg shouldn't receive a system breakpoint event. However even with the plugin loaded and active x32dbg pauses at the system breakpoint which means the debugger is detected by the process somehow.
Possible causes:
If the debugger check is done via checking isDebuggerPresent boolean value in PEB, the following screenshot in ScyllaHide source code shows at the create process event the execution never reaches the PEB patch due to specialPEBFix being initialized to false:
However when the debugger pauses at the breakpoint checking the IsDebuggerPresent value shows it to be false. Which means something after the create process event is indeed patching the PEB properly but not quick enough for it to go completely undetected by the ntdll loader:
The text was updated successfully, but these errors were encountered: