5 ms·
An ideal debugger can't be detected. In the specific case of x86 and int3 bps, you can abuse variable-length instruction encoding to jump into the middle of an
by mappu 10y ago
An ideal debugger can't be detected.
In the specific case of x86 and int3 bps, you can abuse variable-length instruction encoding to jump into the middle of another instruction. Then code execution can differ depending on the presence of 0xcc.
- userbinator 10y agoOne common trick was to make the code itself part of a calculation for decrypting/checksumming/encryption/etc., so any modifications would cause a silent failure much later.
- crististm 10y agoThe game King's Keep on Sinclair Spectrum was (in a way) like that. It had one or two obfuscated subroutines for xor encoding the main program. They were pretty well localized so once I identified them, decompiling the rest was trivial. Fun times then and now :)