Closed 0x000007B closed 3 days ago
hi @0x000007B ! Thanks for reporting, I will check it soon (not at home right now). But the first thing that I noticed is that you are not using the latest TinyTracer (which is 2.7). Can you try first with the latest one?
Also noticed that the case without "Virtualization tools" runs ok. And the recently implemented bypass was for "Usermode + kernelmode debugger" - so this works fine. There is nothing wrong with the "Trap Flag" bypass.
Just the bypass for the mode with "Virtualization tools" is not implemented yet. I will see what exactly it checks for and implement this bypass in the further release. Probably it is about the presence of the injected DLL, or maybe the altered RDTSC.
Hey, @hasherezade !, thanks for the quick reply. Yes my theory was wrong, I thought the "Trap Flag" played in this error. But I was wrong sorry. I now understand, Thanks!
VMPTest.vmp.exe.tag.zip - Trace of the protected test executable, with the AntiVM preset.
VMPTest.zip - Plain EXE (No Protection)
TinyTracer.ini ↓
There is an issue with a tiny tracer currently related to VMProtect. The issue is that when AntiVM is enabled and under the tiny tracer, VMProtect throws an error that says "Sorry this application cannot run under a Virtual Machine.", I'm not on a VM. So I don't know why it's throwing that error while running under a tiny tracer. I suppose the newest tiny tracer update has something to do with this happening. Based on the "Trap Flag". But I'm not so sure.
Regards Dynamic.