0

I'm getting into the world of reverse engineering because I think it would be interesting to know how things work and such (also learning some assembly).

But I have this strange problem, when I'm debugging some code, like a program from crackme.de, the program gets terminated instantly when I try to run it. So to see the changes I've done I actually have to patch it which will be very annoying in the long run I think.

I've tried out different debuggers as well, OllyDbg, IDA Pro (free edition) and Immunity Debugger (going with this one because I like it).

And I still have the same problem. I make some changes, I debug the program (start process), instantly gets Program terminated with code 0 (which is the return value from the program if I understand right).

Any ideas? I must be doing something wrong. I'm running Windows 10 if that might help.

Thanks.

Improve this question

3 Answers 3

Reset to default
1

You're doing everything correct! The problem is an anti-debugging technique. There is a function isDebuggerPresent(), which can check if your program is being debugged or not. This can be seen in the "Newbie" crackmes, as it is really easy to bypass. You can try to disable it yourself, or have a look at similar questions, how to bypass this.

Good Luck!

Improve this answer
0

Does this software have anti-debugging features built into it? I've been doing some research myself recently on Safedisc-protected software (usually video games, just not in my case... retail software). This DRM tool includes anti-debugging features that keep an eye out for popular debuggers running in the background, and actively attempts to thwart such debugging.

There are other such tools than Safedisc (the Sony video game DRM comes to mind, can't think of its name), and I know even less about their details, but they have similar features.

Improve this answer
2
  • I thought about that, but pretty sure that isn't the case. Noob level challenges on crackme.de shouldn't have this feature as it's for beginners. I'll try to make a small piece of software to test to be sure. I can debug code, go into the assembly and change an instruction. But when trying to then run it, it doesn't work and I have to patch the whole executable.
    – mikkel1156
    Nov 10, 2016 at 9:02
  • Post an example of what was original assembly what you charged may be you imbalnce the stack may be you r changes corrupt the instructions etc etc
    – blabb
    Nov 10, 2016 at 12:53
0

Try putting a breakpoint on various process exit points: ExitProcess, TerminateProcess, TerminateThread. If the exit is done by the process itself, you should be able to catch it and then see what could have triggered it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.