J
John Erickson
I'm having problems with several windows programs under vista including
IExplorer.exe, Explorer.exe, and several others. These programs appear to
have code in them that either directly test PIFLAG_DEBUGGER_ATTACHED or make
a system call which I assume does the same test. Then if it indicates that a
debugger is attached, they issue an int 3 (breakpoint). If I have Visual
Studio installed I get a JIT message that allows me to attach a debugger and
nop the int 3, but if I don't have visual studio installed the app (such as
IE or Explorer) simply crashes with an unhandled exception. I suspect that
something somewhere is corrupting the PIFLAG_DEBUGGER_ATTACHED flag causing
it to always indicate that a process is being debugged, but I'm not sure what
is corrupting that flag. I have also seen posts on the net to the effect that
some games (who are trying to prevent hacking and testing by testing that
flag) don't work on Vista because of this problem with
PIFLAG_DEBUGGER_ATTACHED. Is this a known problem and if so is there a fix
for it?
IExplorer.exe, Explorer.exe, and several others. These programs appear to
have code in them that either directly test PIFLAG_DEBUGGER_ATTACHED or make
a system call which I assume does the same test. Then if it indicates that a
debugger is attached, they issue an int 3 (breakpoint). If I have Visual
Studio installed I get a JIT message that allows me to attach a debugger and
nop the int 3, but if I don't have visual studio installed the app (such as
IE or Explorer) simply crashes with an unhandled exception. I suspect that
something somewhere is corrupting the PIFLAG_DEBUGGER_ATTACHED flag causing
it to always indicate that a process is being debugged, but I'm not sure what
is corrupting that flag. I have also seen posts on the net to the effect that
some games (who are trying to prevent hacking and testing by testing that
flag) don't work on Vista because of this problem with
PIFLAG_DEBUGGER_ATTACHED. Is this a known problem and if so is there a fix
for it?