1

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has anti-debugging features and as far as I can understand it modifies its code during the the tls callbacks (at least thats what IDA indicated when stepping through the tls callbacks, there are 3 of them). I suspect the tls callbacks check for debuggers and also it unpacks the executable.

I would like to ask a couple of questions in connection with this.

  • How would you go about reversing a code that is heavly obfuscated? (Lots of jumps and opaque predicates.) Maybe after the tls callbacks finish the code is unpacked and some of the obfuscation is removed?

  • I have added breakpoints to the main debug checking functions from ntdll.dll and kernel32.dll to see if they call any, I saw they had multiple calls to ntqueryprocessinformation, I suspect they are querying their own process?

  • Also, if i want to read the memory of the application during runtime, I will need to find a way to bypass their anti debug features, meaning I have to figure out what they are doing with the tls callbacks and also from the entry point of the PE?

I am looking for any general or specific guidelines you guys can throw me, in order to defeat their obfuscation.

Thank you

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.