0

I'm currently trying to reverse engineer a game,but there's and anti-debug, so far the only leads I've tried to follow are: I found an IsDebuggerPresent API, I tried to change the value of EAX by putting in a hardware breakpoint (write) at the address of the API, then running the debugger and opening general registers and changing EAX it to 0x00000000, but that didn't accomplish anything.

So I want to know how I can find the origin of this popup in IDAenter image description here

that way I can start working backwards from the origin and find out where it comes from.

3

The error you've received was probably thrown by either Themida or WinLicense, a well known protectors. I'd say here that fully bypass of both Themida and WinLicense are goals that are hard to reach for an inexperienced reverse engineer.

Because it's the 3rd question you ask about this subject, and it seems like you are truly struggle with it, I'll show you a quick step-by-step tutorial of how to bypass IsDebuggerPresent on runtime, from inside IDA and avoid the pop-up message.


First, let's create a small program which all it does will be to check whether it was executed inside a debugger or not:

#include <windows.h>
#include <stdio.h>

int main(){
    if (IsDebuggerPresent()) {
        printf("Debugger found\n");
    } else {
        printf("Debugger not found\n");
    }

    return 0;
}

As you can see, the program only contains a main() function which will print "Debugger found" or "Debugger not found", depends on the result of IsDebuggerPresent().

Let's compile the program. I used TinyCC because it is less noisy than some of the other compilers. Basically you can use whatever C compiler for windows you wish.

./tcc.exe check_for_debugger.c

Now that we have an executable .exe file, let's execute it:

./check_for_debugger.exe
Debugger not found

As expected, we ended up with "Debugger not found" printed to the console. Let's open the executable in IDA Pro. As you can see, the main function looks something like this (click on it to enlarge):

main function

Let's execute it. You may want to put a breakpoint before the program exits but not before the message is printed.

We can see that "Debugger found" was printed to the console.

Now let's modify the result of IsDebuggerPresent() by changing the value of eax just after the function was called. For this, we'll create a breakpoint in offset 0x0040100F (in my program) which is where the result of IsDebuggerPresent() is checked by test eax, eax.

Execute the program inside IDA. The program has stopped at our breakpoint on test eax, eax and we can see in the registers panel that eax has non-zero value (in my case eax==1).

eax=1

Let's right click on eax and choose "Zero value", and immediately the value of eax will changed to zero.

enter image description here

Now let's continue the execution (don't forget the breakpoint before exit() in case you removed it for some reason). And as we wanted, the message "Debugger not found" is printed in the console.


Hope you understood how to bypass IsDebuggerPresent by modifying the value of eax, now you can continue your reverse-engineering process.

  • Thanks , I did exactly the same things the last time I posted. I thought it would be simple , well I guess there are more anti-debugging techniques – Ayazasker Dec 16 '17 at 15:23
  • So I did the right thing , but I thought I was doing something wrong. Which means there are more anti-debugging techniques. – Ayazasker Dec 16 '17 at 15:24
  • 1
    That's true, software protectors are reach in anti-debug tricks and as I said, this is not going to be easy at all to completely bypass them. Anyway, this is how you bypass IsDebuggerPresent and if you'll check you can see that probably other anti-analysis trick is catching you. – Megabeets Dec 16 '17 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.