0

Using an hardware breakpoint, I found with Ollydbg that a crackme was checking for the isDebuggerPresent flag. I'd like to find this part of the code using IDA now.

I first looked in the import table, but couldn't find the function in the list and came to the conclusion that the crackme was doing it directly instead of using kernel32.dll. Then I tried to use the "sequence of bytes" search in IDA, using the bytes in OllyDbg's hex dump view corresponding to MOV EAX,DWORD PTR FS:[30] (64 A1 30 00 00 00), no chance here.

I must be missing something very obvious here, this is the most basic anti-debugging technique so there must be a simple way to locate it using IDA, right?

Edit: Screenshot in Ollydbg enter image description here

Edit: Where the check actually happens enter image description here

6
  • Yes it does. But my goal is to be able to find it using IDA too. The address where the code is in Ollydbg is not in the range of the code shown in IDA.
    – Stud
    Nov 3, 2018 at 10:02
  • Sorry I though I uploaded a wrong screenshot. But this is actually where it breaks now.
    – Stud
    Nov 3, 2018 at 10:07
  • Can you share the binary? It's very hard to help only with that information. Nov 3, 2018 at 13:29
  • Sure, here's the link to the crackme: crackmes.one/crackme/5b502da833c5d41c0b8ae514
    – Stud
    Nov 3, 2018 at 13:45
  • @Biswapriyo Read crackmes faq...
    – user202729
    Nov 4, 2018 at 13:30

1 Answer 1

3

Of course you can't find it in the crackme, because the code isn't there. It's easy to determine which file the code belongs to:

Title bar with module name

It's KERNELBA, so it probably comes from a system dll (KERNELBASE.dll?). We expect to find code in module named crackme4 or similar.

Looking at the stack, it's easy to find the address:

Image of stack

That one is not prefixed with <system_module_name>., so I guess it's code from the crackme.

In case the stack is corrupted, it's possible to use Alt+F9 (execute until user code).


About finding the corresponding address in IDA, it's described at this question:

If only the base is changed, but offsets are constant [...], you can just rebase the program in IDA. You can do so by edit->segments->Rebase program ... menu. Specifying the same starting base in IDA as is in Olly should help.

and

Base_Address_in_OllyDbg: The base address of the target module in OllyDbg. You can find this value by pressing Alt-E in OllyDbg (or by going to View --> Executable modules in OllyDbg's menu bar). Find your target module in the Executable modules window; the leftmost field (Base) is the Base_Address_in_OllyDbg.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.