admin/hasherezade-tiny_tracer
1
0
Fork 0
mirror of https://github.com/hasherezade/tiny_tracer synced 2026-06-08 14:36:37 +00:00
Code Issues Packages Projects Releases Wiki Activity
452 Commits 6 Branches 32 Tags
e23fad4bcff8f32297ebd0aa647a57bbd7233313
Commit Graph

63 Commits

Author SHA1 Message Date
hasherezade e23fad4bcf [REFACT] Wrap a variable in AntiDebug namespace 2024-08-09 09:56:36 -07:00
hasherezade d78a9f5fec [REFACT] Wrap global variables used by AntiDebug into a separate namespace 2024-08-09 09:52:57 -07:00
cecio 38b9ce71c2 [FEATURE] Added AntiDebug API OutputDebugString 2023-11-06 22:08:44 +01:00
cecio 9764c17e5b [FEATURE] Added AntiDebug API SwitchDesktop 2023-11-06 21:55:19 +01:00
cecio 9172f0cccc [FEATURE] Added AntiDebug API GetWindowText 2023-11-06 14:30:40 +01:00
cecio fc8a098808 [FEATURE] Added AntiDebug API NtSetInformationThread 2023-09-24 23:50:27 +02:00
cecio c55048dfbb [FEATURE] Added some additional AntiDebug API tracking 2023-09-10 22:50:36 +02:00
cecio 7049d73c25 [FEATURE] Added INT1 in AntiDebug 2023-09-07 21:31:28 +02:00
hasherezade 3352201d60 [BUGFIX] Fixed ANTIDEBUG=2 not working for 32-bit applications. Fixed backward compat with older Pin versions (use INS_OperandWidth instead of INS_OperandSize) 2023-08-26 13:43:17 -07:00
hasherezade 05a820c58f [BUGFIX] In AntiDbg::WatchCompareSoftBrk: moved checks before the instrumentation function. Do not use ins.q() to pass instruction 2023-08-25 17:20:20 -07:00
hasherezade 780a70b752 [REFACT] Small cleanup. Removed unused function. Version up: 2.7 2023-08-25 15:50:12 -07:00
hasherezade f206fa4d12 Merge branch 'master' into master 2023-08-26 00:08:07 +02:00
hasherezade 4b92b89395 [BUGFIX] In Software Debug checks: reworked to remove FPs, check only comparison of the 2nd operand. Only immediate. 2023-08-25 09:11:40 -07:00
hasherezade 9c9a8cc28f [BUGFIX] Before throwing the exception, make sure that the trap flag was set from the same thread. Confirmed bypass of VMProtect ant-dbg checks (Issue #26) 2023-08-17 15:08:20 -07:00
hasherezade 277f0f1d7c [BUGFIX] In Trap Flag bypass: removed skipping the first instruction 2023-08-17 14:54:20 -07:00
Andrea Naspi c4579a254d [FEATURE] AntiDebug: bypass VMProtect anti-debug check based on Trap Flag (#45) 2023-08-17 23:39:37 +02:00
cecio 43175ae0cf [FEATURE] AntiDebug Software Breakpoints detection 2023-08-17 16:50:38 +02:00
hasherezade 6b00551b85 [REFACT] Use common function to log AntiVm and AntiDebug messages 2023-08-16 17:01:38 -07:00
hasherezade 3863f17063 [REFACT] In Windows version check: removed unused variables 2023-08-16 16:40:46 -07:00
hasherezade 49c808389e [REFACT] Do not use Windows.h by default 2023-08-15 08:34:50 -07:00
hasherezade 76d9cce5ee [REFACT] In system info: removed debug strings 2023-08-15 08:28:40 -07:00
hasherezade 817211caae [REFACT] Use PIN functions to retrieve OS version and bitness (rather then Windows native functions) 2023-08-15 08:18:05 -07:00
hasherezade 650fb03b66 [FEAUTURE] Unmangle functions names before use 2023-08-13 11:59:59 -07:00
hasherezade 1c80f078c7 [FEATURE] AntiDebug: added watching interrupts (INT3, INT2D) 2023-08-12 10:13:32 -07:00
hasherezade 396cefb513 [REFACT] Fetch PEB in a separate function 2023-08-12 08:59:29 -07:00
hasherezade 956679c98e [REFACT] In AntiDebug: use namespace AntiDbg, renamed functions 2023-08-12 08:41:38 -07:00
hasherezade d7d7eaca81 [FEATURE] AntiDebug: added automatic clearing of the Trap Flag 2023-08-12 08:30:10 -07:00
hasherezade 2b387d4211 [FEATURE] AntiDebug: added link to the Trap Flag desc. 2023-08-12 08:00:58 -07:00
hasherezade e937d95f46 [BUGFIX] Fixed logging antidebug techniques called from shellcodes 2023-08-12 07:54:16 -07:00
hasherezade ef3ca26b1b [FEATURE] AntiDebug: Detect Trap Flag 2023-08-12 07:40:04 -07:00
hasherezade c25dba46ac [REFACT] In AntiDebug: renamed functions 2023-08-12 06:33:17 -07:00
hasherezade 5e097591f8 [FEATURE] Reduced levels of AntiDebug tracking 2023-08-12 05:41:14 -07:00
hasherezade ef41291768 [REFACT] Removed win_constants.h, define all constants locally 2023-08-11 12:33:19 -07:00
hasherezade db67e6e8da [BUGFIX] In AntiDebug: check arguments count before processing 2023-08-11 12:15:07 -07:00
hasherezade 0c20a51bb9 [REFACT] In AntiDebug: reduced number of watched arguments to 5 (most are unused) 2023-08-11 12:08:01 -07:00
hasherezade 128cd8cac7 [BUGFIX] In AntiDebug: added parameters check 2023-08-11 11:58:29 -07:00
hasherezade 3bdaaf8791 [REFACT] Split antidebug watch into separate functions 2023-08-11 11:37:57 -07:00
hasherezade 91454d205d [NOBIN] In AntiDebug: move links into a new line 2023-08-11 10:35:09 -07:00
hasherezade f55d84f304 [FEATURE] In AntiDebug: modified descriptions 2023-08-11 10:22:35 -07:00
hasherezade a9efbfb3a0 [REFACT] In AntiDebug: add link as an arg of LogAntiDbg 2023-08-11 10:18:03 -07:00
hasherezade 74b5157925 [REFACT] In AntiDebug: CloseHandle - use exitpoint value 2023-08-11 10:08:30 -07:00
hasherezade 6e343aa501 [REFACT] Small refact of WinIsNativeOs32, use namespace 2023-08-10 09:50:43 -07:00
hasherezade 8827e83874 [REFACT] In AntiDebug: refactored fetching Windows version 2023-08-10 09:35:05 -07:00
hasherezade ffc51196bc [REFACT] Check if above vista using native function (backward compat.) 2023-08-10 09:11:57 -07:00
hasherezade a832d1d015 [REFACT] In AntiDebug: use windows functions via wrappers. Explicit definition of Pin namespace 2023-08-10 08:37:17 -07:00
hasherezade 9c857c1ccd [REFACT] In AntiDebug: retrieve IsWow64Process dynamically 2023-08-10 08:20:55 -07:00
hasherezade f9c24f44d6 [REFACT] In AntiDebug: simplified conditions checks 2023-08-09 17:41:03 -07:00
hasherezade 2475263891 [REFACT] Cleanup, removed unused variables 2023-08-09 17:20:23 -07:00
hasherezade 481c6f4dcc [REFACT] Simplified logging antidebug info 2023-08-09 17:17:16 -07:00
hasherezade 0ec8cda7f9 [REFACT] Use delimiters defined in classes 2023-08-09 16:58:24 -07:00