A forum for reverse engineering, OS internals and malware analysis 

Discussion on reverse-engineering and debugging.
 #25000  by kmd
 Mon Jan 19, 2015 5:45 pm
hi guys,

dont think it isn't advertising :D

I'm tried warthunder (wot clone) and surprisely it won't start if windbg is running. Not launcher not game itself. It started after i disabled debug mode. Only after this. The question: how it detect it and how to bypass this, coz i really dont want to do reboot only to start a game and I cant remove windbg coz i use it everyday for work.
TIA
 #25002  by EP_X0FF
 Mon Jan 19, 2015 6:15 pm
NtQSI(SystemKernelDebuggerInformation), KdDebuggerEnabled flags? I don't really want to download gigabytes of this to put one single exe into debugger.
 #25092  by kmd
 Wed Jan 28, 2015 5:27 pm
yeah they have this check in all exe-s, maybe sort of shared framework, anyway simple patch of NtQuerySystemInformation did the job.