Trap Flag - Anti-debugging trick

Question

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with:

So apparently it's generating an exception with

XOR DWORD PTR [ESP], 154h

Which ultimately terminates with a call to ExitProcess() without even running the program.

I tried using NOPs to bypass this but since upon execution the EP is already pointing to this problematic piece of code it did not work.

How can I bypass this and what's really triggering the exception?

Answer 1

It is setting a trap flag with that xor instruction

when it is run normally (not under debugger)

the trap flag is triggered so the handler gets a chance to execute

when the binary is run under debugger the trap flag is ignored and the handler doesn't get a chance to execute

hard patch to point to the handler directly or simply change the eip in debugger for analyzing

your screenshot looks like you are using ollydbg

if so just press shift + f9 after setting a breakpoint at 0x401060 @ the seh handler that would pass the exception to the program and would bypass the trick