I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has anti-debugging features and as far as I can understand it modifies its code during the the tls callbacks (at least thats what IDA indicated when stepping through the tls callbacks, there are 3 of them). I suspect the tls callbacks check for debuggers and also it unpacks the executable.

I would like to ask a couple of questions in connection with this.

  • How would you go about reversing a code that is heavly obfuscated? (Lots of jumps and opaque predicates.) Maybe after the tls callbacks finish the code is unpacked and some of the obfuscation is removed?

  • I have added breakpoints to the main debug checking functions from ntdll.dll and kernel32.dll to see if they call any, I saw they had multiple calls to ntqueryprocessinformation, I suspect they are querying their own process?

  • Also, if i want to read the memory of the application during runtime, I will need to find a way to bypass their anti debug features, meaning I have to figure out what they are doing with the tls callbacks and also from the entry point of the PE?

I am looking for any general or specific guidelines you guys can throw me, in order to defeat their obfuscation.

Thank you

2 Answers 2


You can press Ctrl+E to select the TLS entry point. see here: https://hex-rays.com/blog/tls-callbacks/


There are multiple ways an application could use to detect the debugger presence using NtQueryInformationProcess() since it retrieves information from a process for example most common use:

ProcessDebugPort, which receives a DWORD value equal to 0xFFFFFFFF (decimal -1) if the process is being debugged.

 lea eax, [dwReturned]
 push eax ; ReturnLength
 push 4   ; ProcessInformationLength
 lea ecx, [dwProcessDebugPort]
 push ecx ; ProcessInformation
 push 7   ; ProcessInformationClass
 push -1  ; ProcessHandle
 call NtQueryInformationProcess
 inc dword ptr [dwProcessDebugPort]
 jz being_debugged  
 push -1
 call ExitProces

A simple solution is to set a breakpoint where NtQueryInformationProcess() returns and when the breakpoint is hit patch with DWORD value 0.

For Obfuscation, there is no direct path to deal with it but I usually try to classify and read the ASM code carefully to identify any known obfuscation techniques first such as:

  • Logic Flow Obfuscation

                xor eax,eax     << zero eax
                test eax,eax    << Check if eax ZERO 
                JE _eaxWasZero
  • NOP Obfuscation

                 push eax
                 add eax,ecx
                 sub eax,ebx
                 push ebx
                 sub ebx, EDX
                 xor ebx, edi
                 pop ebx
                 pop eax
  • Anti-Disassembler Code Obfuscation which is used to confuse the disassembler by adding junk bytes and fake function return address

  • Trampolines (code jumps to different locations)

  • Instruction Permutations (make simple instructions complex)

and then simplify it in order to identify the logic or any anti debugging trick.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.