How to bypass anti debugger? IDA Pro

Question

Im new to reverse engineering and doing a crackme that requires me to make a keygen, yes i know making a keygen isn't a beginner task however im stuborn, i am trying to debug the program to understand what it does to check for a valid key but i continue to get hit with the "A debugger is present on your computer" text the program prints out, I am aware of where it is checking for the debugger (i think), i just don't know how to avoid it, i can't patch the file so ive got to avoid it without tampering with the original code, anybody know how to get past this or? Thanks i'd really appreciate it.

Answer 1

I'll try to "teach you to fish" and provide a good general process to bypass these checks while debugging (without patching the binary)

1. Set a breakpoint on the call of interest (e.g. IsDebuggerPresent)
2. Single step in your debugger
3. Identify which register was modified (and how) based upon the return value of the call e.g. perhaps it was eax. (<< this is probably architecture specific)
4. Single step in your debugger. At this point if you're using a debugger like IDA free and viewing in graph mode (hit spacebar to toggle between the listing view and graph view) you should see a flashing line that connects the current code block to the "bad" code block. In this case "bad" just means the code block that you DON'T want to reach aka the exit() block, etc.
5. Modify value that was identified in step 3. If you're using IDA free you can right click on the register > modify value. If it's currently a 0 and the bad branch is flashing, generally you can just change it to a non-zero value (e.g. 1) to get the good branch to flash

Note: it is helpful to actually understand how the function works. e.g., if a debugger is present this function will return XX, otherwise it will return YY. That way you're not arbitrarily modifying values... you can do so with intention.

Hope this helps!