0

So I have a crackme my friend sent to try and crack it but the problem that I cannot bypass the anti-debugging or even patching it.

I even tried using ScyllaHide at max settings but still it detects that there's a debugger and close itself without any message, and it encrypts its strings in memory, so I can't get the key.

How can I prevent it from detect if there was a debugger or getting the key from memory? (BTW I knew that it encrypts string being entered and compares it to the another encrypted string)

Improve this question
2
  • 1
    Have you tried to identify what type of anti-debugging is present in this binary ? If not, it's going to be difficult to answer your question without more details ...
    – Guillaume
    Jul 29 '21 at 12:00
  • in IDA there was a functions like: UnhandledExceptionFilter IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetTickCount QueryPerformanceCounter GetModuleHandle GetExceptionCode and other ones
    – Ahmed minegames
    Jul 29 '21 at 16:08
0

use a debugger, single step the code, and watch what it does. Odds are, it's one of the windows API functions that Ahmed mentions in another response. But, step 1 would be figure out what it's doing, and then using the debugger, just jump OVER that code.

Improve this answer
1
  • i made a program that will gonna instead edit it in memory and it worked without patching the file itself (because it's have an Anti File-Patching anyway), but i will mark your answer as solved, because why not.
    – Ahmed minegames
    Aug 15 '21 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.