Re: [GD-General] Is it possible to detect debugging?

[Colin F. <cp...@ea...>]

> [...] Nor could you restore a memory 
> snapshot and expect the application state and graphics card state to also 
> magically return to an operational condition. 

It worked on the Commodore 64 for the most part because a 64 KB 
memory image really was (almost) the complete state of the computer!

On the PC, I guess it's one thing to take a snapshot of EVERYTHING
(operating system, all applications) to be restored later, and a
very different thing to take a snapshot of a single application.
Even ignoring the problem of hardware devices having state (like
graphics cards and sound cards), restoring the code and memory of
an application would not actually claim any resources from the
operating system (memory allocations, open file handles, sockets,
semaphores, windows, various DirectX interfaces, properly loaded 
DLLs).  I suppose one could attempt to record and play back 
requests for such resources after the memory image had been restored,
but one would probably need to fix up random memory locations 
according to the ACTUAL acquired window handle and various other
handles and values.  Even if the original snapshot was taken 
when the application was JUST starting up, before initializing 
sound and graphics, it might be quite tricky.

...but, hey, that's how the nu-B haX0r bec0mes a PN3637!

> I've had a few games with CD-copy protection (eg. The Sims) refuse to load 
> because I was running SoftICE (A debugger that runs below the OS). I'm sure 
> that I could have stepped through the 'debugger detection' routine and 
> skipped it if I really wanted to but the hassle was enough of a deterant for 
> me (I just rebooted without it...) and I guess a large majority of would-be 
> crackers would just get stumped by your super-37173 crack detection and not 
> be able to figure out which jump command to modify. ):

Maybe 1,000 totally diverse checks will tucker out even the 
determined cracker.  The saved game file for GTA3 seemed to 
have a simple CRC code in it -- and that was enough to make 
me give up on messing with it!  I think it's definitely worthwhile
to put in really simple checking, because it must greatly 
reduce the number of people with the patience and ability
willing to continue hacking the application.  Any effort beyond
that depends on how long one wants to delay piracy or cheating.

--- Colin