Welcome to the new Woodmann RCE Messageboards Regroupment
Please be patient while the rest of the site is restored.

To all Members of the old RCE Forums:
In order to log in, it will be necessary to reset your forum login password ("I forgot my password") using the original email address you registered with. You will be sent an email with a link to reset your password for that member account.

The old vBulletin forum was converted to phpBB format, requiring the passwords to be reset. If this is a problem for some because of a forgotten email address, please feel free to re-register with a new username. We are happy to welcome old and new members back to the forums! Thanks.

All new accounts are manually activated before you can post. Any questions can be PM'ed to Kayaker.

New plugin for OllyDbg

Plugin related discussions.

For plugins, tools and tutorials see <a href="/collaborative/tools/index.php/Category:OllyDbg_Extensions">OllyStuph</a>
Aster!x
Junior Member
Posts: 22
Joined: Sun May 18, 2003 8:09 pm

New plugin for OllyDbg

Post by Aster!x »

This plugin allows to hide debugger from IsDebuggerPresent API
function.
Attachments
HideDebugger.zip
(2.25 KiB) Downloaded 1001 times
User avatar
dELTA
Posts: 4209
Joined: Mon Oct 30, 2000 7:00 am
Location: Ring -1

Post by dELTA »

Cool, nice work! :cool:
Aster!x
Junior Member
Posts: 22
Joined: Sun May 18, 2003 8:09 pm

Post by Aster!x »

dELTA wrote:Cool, nice work! :cool:
Thanks! :)
Js
Member
Posts: 84
Joined: Thu Aug 16, 2001 4:47 pm

Hidedebugger/IsDebuggerpresent

Post by Js »

Hi Aster!x,
Always happy to see new tot. Not much documentation, out of curiosity, how does this compare/improve on the already available Isdebuggerpresent plugin?
regards
User avatar
Kayaker
Posts: 4169
Joined: Thu Oct 26, 2000 11:00 am

Post by Kayaker »

Hi Aster!x,

Kudos on the plugin. If you don't mind a couple of comments, the nicest thing you could do is teach people how to create their own Olly plugins by including the source. I fully encourage all forms of source on this board as it's the best kind of information to pass along.

I mention this specifically because, not to take away any credit at all from what you have done, but because SV also created an IsDebuggerPresent plugin and included full ASM source. I haven't actually tested either plugin, but comparing the two dlls it seems you have done it slightly different, using ContinueEventDebugHook and WaitForDebugEventHook and a different combination of _ODBG exports. It might be instructive if you included your source and people who are interested could compare the different approaches.

This is just a suggestion, and an encouragement for further plugins and open source, from which we all benefit.

Heh, I see Js (long time no Asp-talk ;-) had the same idea.

Cheers,
Kayaker
Aster!x
Junior Member
Posts: 22
Joined: Sun May 18, 2003 8:09 pm

Post by Aster!x »

Hi Js!
My english not so good for give more full description :( , but you may try and choose for itself best. ;)
Aster!x
Junior Member
Posts: 22
Joined: Sun May 18, 2003 8:09 pm

Post by Aster!x »

Hi Kayaker!

I'll think.
Possible little later full sorces will be available on _http://www.wasm.ru/
and accordingly will here appear link. :)
Aster!x
Junior Member
Posts: 22
Joined: Sun May 18, 2003 8:09 pm

Post by Aster!x »

Code was corrected.
The size of the file became else less.
Attachments
HideDebugger101.zip
(2.22 KiB) Downloaded 422 times
doug
Senior Member
Posts: 218
Joined: Sat Jan 04, 2003 6:49 am

Post by doug »

if you need help on the translation part, let us know..

there's a lot of valuable content on wasm.ru that just doesn't get to be known by the rest of the world.

The other day I was searching for undocumented windows features and out of 6 google searches, wasm.ru stuff was there 5 times..
Aster!x
Junior Member
Posts: 22
Joined: Sun May 18, 2003 8:09 pm

New version

Post by Aster!x »

New version of plugin
Attachments
HideDebugger12.zip
(3.33 KiB) Downloaded 356 times
JMI
Senior Member
Posts: 5329
Joined: Wed Apr 25, 2001 2:00 pm

Post by JMI »

Thanks for the update. :yay:

Regards,
JMI
Aster!x
Junior Member
Posts: 22
Joined: Sun May 18, 2003 8:09 pm

Hide Debugger 1.2.2 has been released

Post by Aster!x »

Hide Debugger 1.2.2 has been released

more options added
Attachments
HideDebugger122.zip
(3.97 KiB) Downloaded 499 times
pLayAr

Post by pLayAr »

good work :) & thanks
Aster!x
Junior Member
Posts: 22
Joined: Sun May 18, 2003 8:09 pm

Post by Aster!x »

added protection against OutputDebugString exploit

attachment deleted because plugin may crash Olly if debug string has READONLY access, will soon be a new version.
Piccinano

Post by Piccinano »

Good work!

Thanks!
Locked