The anti-attach & anti-debug is better in the newer version. i'll test it a bit more.

do you have a version of the plugin with anti-debug/attach only? are you self debugging?

readelf -a keygen on debian 6 (2.6.32-5-amd64) gives this output ELF Header: Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC (Executable file) Machine: Intel 80386 Version: ...

Damn, I need 64 bit too

Sorry, Enigma, this is sort of a double post. I see you recommending VM for this issue, but VM shouldn't work if it's a piece of data (not code) that can be reliably located, correct? to boboi1986: can you give an example of what's being modified? Is it code? Is it data? If it's data, what's the len...

Of course, if it's effective for his problem. I assumed he meant some piece of data (not code) was being modified in memory. If it is indeed a piece of data, and it's beyond his control to somehow encrypt that data he doesn't have many options. Your VM wouldn't protect against that, would it? Especi...

Like he said, you can't really stop memory hacking. ReadProcessMemory/WriteProcessMemory can't really be blocked unless you want to make a driver and hook them system wide. Same goes for hiding processes. You just can't do the things you want to do, you have think of a more creative solution. If the...