Bypassing BlackMatter Anti-Debug With x64dbg [Patreon Unlocked]

[@robbie_984]

Excellent video. A tip for those who want to "automate" the skip so you don't have to change the IP every time. Check the function out and if it is just calling NtSetInformationThread or some other anti-debug code and it doesn't contain important malware code (which it usually doesn't since it is isolated anti-debug function) you can simply NOP the whole call and skip over that check every time you restart the exe\dll in the debugger.

[@OALABS]

Nice tip!

[@sylvesterangiho9146]

Pls I want to learn software how can you help me please

[@pedrobarthacking]

Amazing content! Please do more videos Reverse engineering context! thank you.

[@surajsawant6469]

this is amazing... nice work. thanks for sharing.

[@az2252]

I never thought about using graph view while using x64 lol As always, your vids are the best.

[@OALABS]

Thanks! Sometimes it's very useful to see see the control flow from another perspective.

[@mytechnotalent]

Brilliant as always!

[@qweoiwjewiodc1954]

Excellent video

[@Axcmotora]

Thank you for this Good turtorial :)

[@hannahprobably5765]

features ! love them all 🚩❤

[@hisokamorow5495]

Hi thank you for everything you give 👍 my question i have run a program but PID doesn't show on 64xdbg, is there any way that i can bypass that

[@_why_3881]

What would be the approach when the exe reproduces itself and its threads (like in process explore you can see 6times the same process)

[@OALABS]

That's a completely different topic ;) You may want to check out some of our process injection unpacking tutorials.

[@lucasjulianlacognata6670]

Thanks Teacher, have you considered writing a book about reversing?

[@OALABS]

No books, just live workshops and videos : )

[@wittingsun7856]

Couldn't you have inserted a jump instead of the push 0?

[@dmitriydibenko5529]

May I ask you to make a video about Software Nanomites?)

[@OALABS]

No, lol

[@dmitriydibenko5529]

Almost the same trick, as Enigma does to detach from the debugger. However, if I remember correctly, Enigma uses ZwSetInformationThread instead

[@sylvesterangiho9146]

Hi please help me crack my software

[@SilentGaming-SG]

Can this method remove the x63dbg (32bit) virus???

[@atoma8921]

Where is the part II?

[@OALABS]

On our Patreon : ) www.patreon.com/posts/analyzing-anti-57443723

[@Sezdik]

hello, is there someone sleeping while you record? there is background voice.. like snoring ... just sayn

[@OALABS]

Haha that's my bulldog Boris. If you check out our streams on Twitch you will see he sleeps beside my desk and has his own doggo cam

[@nonskeetuser760]

I think i want to marry this man