I have an address, that I think is not allowing me to run the debugger in IDA, I need help trying to stop it.
Also , what does
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
Let's have a look of the function's description in MSDN:
Determines whether the calling process is being debugged by a user-mode debugger
As you guessed, this function is commonly used as an anti-debugging trick with the aim to break the process whenever the program detects that it is being debugged.
IsDebuggerPresent checks for the BeingDebugged flag in the PEB (Process Environment Block) and will return a non-zero value if it is indeed being debug.
You have several options to bypass this trick, some of them are:
Modify the PEB itself by injecting this code:
mov eax,dword ptr fs: mov eax,dword ptr ds:[eax+30] mov byte ptr ds:[eax+2],0
This will patch the
BeingDebugged flag in the PEB, ensuring
IsDebuggerPresent always returns 0.