The ultimate stealth method
Hex-Rays (hexrays) <infohex-rayscom> Sunday, November 20 2005 15:06.17 CST


The last described method does not work if the application uses an "unsupported" antidebugging trick. For example, if the application directly checks the PEB field instead of calling the IsDebuggerPresent function, the method will fail. Or the application could use something else, something from the future...



Comments
Posted: Wednesday, December 31 1969 18:00.00 CST