I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return
True every time a specific program calls
IsDebuggerPresent, without actually debugging the program.
Since I'm not a software developer, I'd really rather avoid writing code to do API hooking. My next thought was to use a modified
kernel32.dll in the same directory as the program, counting on "DLL Load Order Hijacking". So... I modified a copy of the dll, essentially replacing the export for
mov eax, 1
If I open the DLL in IDA and examine the export, it shows exactly the code I patched in, but if I run the executable, when it makes the call to
IsDebuggerPresent the same address I modified instead shows a JMP to the proper
Is what I'm trying to do even feasible, or do I have to do API hooking to make it work? I'm Really looking for a simple POC, so again, I'd prefer not to have to figure out a metric buttload of C++ just to test a theory.