search

x64dbg / ScyllaHide

Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide
GNU General Public License v3.0
3.4k stars 422 forks source link

ScyllaHide OutputDebugStringA protection for OllyDbg 2.0 doesn't work #54

Open trietptm opened 6 years ago

trietptm commented 6 years ago

Hi, I use ScyllaTest_x86.exe and see that ScyllaHide OutputDebugStringA protection for OllyDbg 2.0 doesn't work.

snap 2018-03-16 at 15 35 47 snap 2018-03-16 at 15 36 01

This problem was mentioned in Twitter 4 years ago too: https://twitter.com/AshAbdalhalim/status/494700460838625280

Mattiwatti commented 6 years ago

Checking this fixes it for me:

lol_olly

Alternatively you can just select 'don't consume any' which is the same as checking all three boxes in Olly v2 or all infinity boxes in Olly v1.

I will leave this open for now because I discovered that OllyExceptionHandler (which is supposed to be a hook in Olly's debug loop to fix stuff like this) is never installed at all for most of the default profiles. There is still a check for each individual setting within the hooked loop itself so you wouldn't get any unwanted changes in behaviour, and as far as Olly hacks go it is a work of art compared to some of the shit found in olly1patches.cpp.

I think it makes sense to apply the debug loop hook in Olly no matter what, given how broken some of it is by default. But I never use Olly myself so I'm a bit lost re: what would be reasonable/useful settings to enable for the default profiles.