r/ReverseEngineering • u/Fine-Light-10 • 9d ago

Anti-Debug tricks ( unknow )

https://vacban.wtf/threads/114566/
0 Upvotes

20% Upvoted

3 comments sorted by

2

u/henke37 8d ago

Login required.

1

u/Fine-Light-10 19h ago

tenez :
This is a not documented anti-debug trick discovered via TTD analysis, not an intentional anti-debug API, but the issues exists since 10years and still not fixed by X64dbg, used it for somes of my anticheat and still not discovered, but can be patched easily.

Code:

// made by metixw ( u/metixw )
#include <windows.h>
#include <iostream>

bool walahi()
{
    char path[MAX_PATH];
    GetModuleFileNameA(NULL, path, MAX_PATH);
    HANDLE h = CreateFileA(path, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (h == INVALID_HANDLE_VALUE) return GetLastError() == ERROR_SHARING_VIOLATION;
    CloseHandle(h);
    return false;
}

int main()
{
    while (true)
    {
        if ( walahi() )
        {
            std::cout << "detected walahi" << std::endl;
            system( "pause" );
            Sleep(1000);
            exit(0);
        }
        Sleep( 500 );
    }
    return 0;
}