jumper Posted March 25 Posted March 25 On 11/18/2021 at 5:05 AM, sabre_chen said: Use IDA to find the callee of IsDebuggerPresent, it is called with parameter value 0Ch. This is PF_NX_ENABLED flag to check the Data Execution Prevention which is not available in Windows 95. Not IsDebuggerPresent, but IsProcessorFeaturePresent. (IsDebuggerPresent takes no parameters.)
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now