Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways.
Steps i Followed are shown in this guide:
https://stackoverflow.com/questions/10330147/how-do-i-bypass-isdebuggerpresent-with-ollydbg
If you are using OllyDbg, I suggest installing an anti-anti-analysis plug such as ScyllaHide. For ScyllaHide, grab the latest from the releases and follow the instructions in the ScyllaHide.pdf document. Then you can try the various techniques simply through a set of checkboxes.
Generally, if you suspect that a particular anti-analysis technique is being used but your mitigation technique is not working, then you should check for that anti-analysis technique manually. To do this with IsDebuggerPresent, or any other API call, go to the function (in Ollydbg, ctrl-g and enter "IsDebuggerPresent" without the quotes) and set a breakpoint (F2 for software BP, or right-click -> breakpoint -> hardware) on the first instruction or any instruction before the first branch (e.g. jmp, conditional jump, call). Sometimes the program will check for a change to certain APIs or skip over the first few instructions.
