-1

i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways.

Steps i Followed are shown in this guide:

https://stackoverflow.com/questions/10330147/how-do-i-bypass-isdebuggerpresent-with-ollydbg

|improve this question
  • 1
    Maybe the program uses more than this one technique to detect debugging. Share the binary so that we can have a look – Paweł Łukasik Apr 29 at 9:23
  • @PawełŁukasik to share it should i upload the .exe or what should i do? Thanks for replying. Tought no one was going to help me – xSePzEr Apr 29 at 18:31
  • 1
    Yes, sharing the .exe might help you get some answers. Without that it just speculation what might be happening. – Paweł Łukasik Apr 29 at 22:01
  • I've uploaded the file, if you are going to check it out please let me know everything about what can the problems be and if it's not a hassle the way to fix all that. I will give u some things that i think it has: -First, debug protection obviously, also, -it detects what program are we using or something like that and closes the program, i tried dnspy and Olly and it kills those processes. -It wont work if trying to deobfuscate with de4dot - [link]mediafire.com/file/1e0ua9jt3ajpju9/UnpackMe.exe/file - Please lmk if u find out the way to patch it. Thanks for everything! – xSePzEr Apr 30 at 10:06
1

If you are using OllyDbg, I suggest installing an anti-anti-analysis plug such as ScyllaHide. For ScyllaHide, grab the latest from the releases and follow the instructions in the ScyllaHide.pdf document. Then you can try the various techniques simply through a set of checkboxes.

Generally, if you suspect that a particular anti-analysis technique is being used but your mitigation technique is not working, then you should check for that anti-analysis technique manually. To do this with IsDebuggerPresent, or any other API call, go to the function (in Ollydbg, ctrl-g and enter "IsDebuggerPresent" without the quotes) and set a breakpoint (F2 for software BP, or right-click -> breakpoint -> hardware) on the first instruction or any instruction before the first branch (e.g. jmp, conditional jump, call). Sometimes the program will check for a change to certain APIs or skip over the first few instructions.

|improve this answer
  • Hello, Thanks for replying! I've already installed ScyllaHide and i tried it on x64dbg and i did too in Olly, the program anyways will end up closing, i've tried different profiles from scylla, i've patched IsDebuggerPresent too but that's not enough, the program will still close. Looks like there are lots of protections on the file. If you want i can give you the .exe so u check it out. – xSePzEr Apr 30 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.