x64dbg / ScyllaHide

Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide
GNU General Public License v3.0
3.48k stars 434 forks source link

Bypass detection on start #152

Open prj opened 1 year ago

prj commented 1 year ago

Some protectors, e.g. Obsidium fail to start the app even if a debug tool is running and generate an error message. For example IDA or Ollydbg.

I don't mean trying to actively debug anything or attached, just having the app open generates an error message. Is it doing a simple loaded module check/window title scan or something? IsDebuggerPresent and friends should all be false, since no debug functionality is being used at all.