Fixing the VMProtect 3.5.1 Win32 Runtime Compilation Issue
Fixing the VMProtect 3.5.1 Win32 runtime compilation issue, a troubleshooting walkthrough for a protected binary that won't compile, with the analysis method shown end to end.
Tag: anti-debug
Hooking Every Kernel Export to Analyze a Driver's Logic
Hooking every kernel export to analyze a driver's logic, a brute-force approach to mapping exactly what a Windows driver calls at runtime, with the result and caveats spelled out.
Bypassing bilibili's Frida Detection (7.26.1 → 7.76.0)
Bypassing bilibili's Frida detection, working through the checks the app runs at startup and neutralizing them to keep instrumentation attached, so you can reproduce it yourself.
Bypassing libmsaoaidsec.so Frida Anti-Debugging in an Unpacked App
Bypassing libmsaoaidsec.so Frida anti-debugging, walking through the detection routines and patching them so Frida stays hidden on the device, including the pitfalls and the fix.
Bypassing the New iQIYI libmsaoaidsec.so Frida Detection
Bypassing iQIYI's updated libmsaoaidsec.so Frida detection, working around its new anti-debug checks to keep Frida attached to the app, with the analysis method shown end to end.
Hikari Source Analysis — AntiDebug
Source analysis of Hikari's AntiDebug LLVM pass, how it injects randomized ptrace-based anti-debugging checks into iOS binaries at compile time, and the internals laid out in detail.
Bypassing an Unusual Anti-Debug & Anti-Hook in a Commercial Mobile-Game Packer
Bypassing an unusual anti-debug and anti-hook in a commercial mobile-game packer, defeating TracerPid and breakpoint detection on ARM64, and the bypass logic broken down.