Searching for a sequence of bytes in IDA

Question

Using an hardware breakpoint, I found with Ollydbg that a crackme was checking for the isDebuggerPresent flag. I'd like to find this part of the code using IDA now.

I first looked in the import table, but couldn't find the function in the list and came to the conclusion that the crackme was doing it directly instead of using kernel32.dll. Then I tried to use the "sequence of bytes" search in IDA, using the bytes in OllyDbg's hex dump view corresponding to MOV EAX,DWORD PTR FS:[30] (64 A1 30 00 00 00), no chance here.

I must be missing something very obvious here, this is the most basic anti-debugging technique so there must be a simple way to locate it using IDA, right?

Edit: Screenshot in Ollydbg

Edit: Where the check actually happens

Answer 1

Of course you can't find it in the crackme, because the code isn't there. It's easy to determine which file the code belongs to:

It's KERNELBA, so it probably comes from a system dll (KERNELBASE.dll?). We expect to find code in module named crackme4 or similar.

Looking at the stack, it's easy to find the address:

That one is not prefixed with <system_module_name>., so I guess it's code from the crackme.

In case the stack is corrupted, it's possible to use Alt+F9 (execute until user code).

---

About finding the corresponding address in IDA, it's described at this question:

If only the base is changed, but offsets are constant [...], you can just rebase the program in IDA. You can do so by edit->segments->Rebase program ... menu. Specifying the same starting base in IDA as is in Olly should help.

and

Base_Address_in_OllyDbg: The base address of the target module in OllyDbg. You can find this value by pressing Alt-E in OllyDbg (or by going to View --> Executable modules in OllyDbg's menu bar). Find your target module in the Executable modules window; the leftmost field (Base) is the Base_Address_in_OllyDbg.