cccs-mog

Those two techniques are reliably detected by the script: 1. https://anti-debug.checkpoint.com/techniques/assembly.html#instruction-counting 2. https://anti-debug.checkpoint.com/techniques/misc.html#parent-process-check-ntqueryinformationprocess I can provide the zip_compound I have used to execute the test if wanted. The fix for...

[ShowStopper_compound.zip](https://github.com/user-attachments/files/22687022/ShowStopper_compound.zip) Just running it normally for now with the differents flags for it https://github.com/CheckPointSW/showstopper/blob/master/DOCS.md. Planning on testing it while tracing it and/or in different context next week !

Hi @ChrisThibodeaux, can you confirm if this is something only happening for this environment variable (namely subscription_id) you did face this for others as well ? Also could you give...