search

hasherezade / tiny_tracer

A Pin Tool for tracing API calls etc
1.25k stars 138 forks source link

INT2D #34

Closed OmuZer closed 1 year ago

OmuZer commented 1 year ago

Hi, i have a program which is using the INT2D for anti debug. And while running tiny_tracer under the application i confirmed its INT2D anti debug.... Is there any workaround to this? Thanks. EDITED (I saw the hide branch, but it seems so the INT2D flag is not cleared.)

hasherezade commented 1 year ago

hi @OmuZer ! I added logging about those interrupts. Example:

cbbd;kernel32.SetLastError
10133;ntdll.RtlLeaveCriticalSection
8dcc;INT:2d
1011f;ntdll.RtlEnterCriticalSection

Once you have it tagged, you can just patch it out. For now I am not planning on adding automatic bypasses for any AntiDebug techniques, only to inform about them. Maybe in the future.

OmuZer commented 1 year ago

@hasherezade, Sorry for the late reply. I was busy, but i saw that commit for the logging of "interrupts instructions" that is very helpful, thanks so much! I really appreciate it :).