Using an hardware breakpoint, I found with Ollydbg that a crackme was checking for the isDebuggerPresent flag. I'd like to find this part of the code using IDA now.
I first looked in the import table, but couldn't find the function in the list and came to the conclusion that the crackme was doing it directly instead of using kernel32.dll. Then I tried to use the "sequence of bytes" search in IDA, using the bytes in OllyDbg's hex dump view corresponding to MOV EAX,DWORD PTR FS:[30]
(64 A1 30 00 00 00), no chance here.
I must be missing something very obvious here, this is the most basic anti-debugging technique so there must be a simple way to locate it using IDA, right?