2

I have an address, that I think is not allowing me to run the debugger in IDA, I need help trying to stop it.

Also , what does kernel32_IsDebuggerPresent mean?

enter image description here

9

Let's have a look of the function's description in MSDN:

Determines whether the calling process is being debugged by a user-mode debugger

As you guessed, this function is commonly used as an anti-debugging trick with the aim to break the process whenever the program detects that it is being debugged. IsDebuggerPresent checks for the BeingDebugged flag in the PEB (Process Environment Block) and will return a non-zero value if it is indeed being debug.

You have several options to bypass this trick, some of them are:

Runtime patching:

  • Set EAX to zero after IsDebuggerPresent being called
  • Modify the PEB itself by injecting this code:

    mov eax,dword ptr fs:[18]
    mov eax,dword ptr ds:[eax+30]
    mov byte ptr ds:[eax+2],0
    

    This will patch the BeingDebugged flag in the PEB, ensuring IsDebuggerPresent always returns 0.

  • You can use a plugin like idastealth

Permanent Patching:

  • You can fill the call to IsDebuggerPresent with NOPs or something similar to skip the check
  • 1
    Great post! UV for the fact that you posted multiple ways! :) – Graham Best Dec 15 '17 at 20:54
  • Thanks for the fast response. How do I stop it right after IsDebuggerPresent? – Ayazasker Dec 15 '17 at 20:59
  • Step over the call to the function, then go to the registers panel, right click on EAX (or RAX) and select "Zero value". This will zero the value of the register. You can also choose a register and press "0" on the keyboard as a shortcut. – Megabeets Dec 15 '17 at 21:01
  • Uh yeah about that I'm on graph view , I see the call function I click call to highlight. I go to the registers , bam they're empty – Ayazasker Dec 15 '17 at 21:34
  • Hey @Megabeets , sorry for not having marked it by the way I figured this out a long time ago but it's actually virtualized software which detects if there's a debugger from input output 5658, I'll mark it – Ayazasker Apr 22 '18 at 0:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.