A blog regarding reverse engineering, game hacking and the Windows operating system
Part 4 – Evaluation You are reading Part 4: Evaluation and Results. 👉 Part 1: Theory 👉 Part 2: Detection 👉 Part 3: Implementation 🔗 Explore the complete project here: GhostDebug on GitHub Evaluation and Results In this chapter the detectability of the newly developed debugger is examined. First the test environment is described. Then the detectability is measured and compared to cl...
Part 3 – Implementation You are reading Part 3: Implementation. 👉 Part 1: Theory 👉 Part 2: Detection 👉 Part 4: Evaluation 🔗 Full implementation is available at: GhostDebug on GitHub Implementation In this chapter an overview of the requirements for the debugger is given first. Then the underlying architecture is described, with focus on the division into different components: a deb...
Part 2 – Detection You are reading Part 2: Detection. 👉 Part 1: Theory 👉 Part 3: Implementation 👉 Part 4: Evaluation 🔗 Check out the source code here: GhostDebug on GitHub Reasons for Debugger Detection Because debuggers allow deep insight into the execution of a program, in many areas there is a desire to prevent debugging. This desire is not limited to malware that wants to make ...
Part 1 – Theory You are reading Part 1: Theory. 👉 Part 2: Detection 👉 Part 3: Implementation 👉 Part 4: Evaluation 🔗 The debugger project itself can be found here: GhostDebug on GitHub Introduction Debuggers are important tools in software development and in reverse engineering. They make it possible to analyze program execution, find errors, and gain deeper insights into the flow o...
Introduction Most people in the game hacking community write their kernel-mode drivers to get around kernel-level anti-cheats such as EasyAntiCheat. However, those anti-cheats have several methods to detect cheat drivers. The most commonly used way to load the cheat driver is manually mapping it with tools like kdmapper. Unfortunately, manually mapping a driver in this way causes the code to be...