4

Im new to reverse engineering and doing a crackme that requires me to make a keygen, yes i know making a keygen isn't a beginner task however im stuborn, i am trying to debug the program to understand what it does to check for a valid key but i continue to get hit with the "A debugger is present on your computer" text the program prints out, I am aware of where it is checking for the debugger (i think), i just don't know how to avoid it, i can't patch the file so ive got to avoid it without tampering with the original code, anybody know how to get past this or? Thanks i'd really appreciate it.

enter image description here

1

2 Answers 2

4

I'll try to "teach you to fish" and provide a good general process to bypass these checks while debugging (without patching the binary)

  1. Set a breakpoint on the call of interest (e.g. IsDebuggerPresent)
  2. Single step in your debugger
  3. Identify which register was modified (and how) based upon the return value of the call e.g. perhaps it was eax. (<< this is probably architecture specific)
  4. Single step in your debugger. At this point if you're using a debugger like IDA free and viewing in graph mode (hit spacebar to toggle between the listing view and graph view) you should see a flashing line that connects the current code block to the "bad" code block. In this case "bad" just means the code block that you DON'T want to reach aka the exit() block, etc.
  5. Modify value that was identified in step 3. If you're using IDA free you can right click on the register > modify value. If it's currently a 0 and the bad branch is flashing, generally you can just change it to a non-zero value (e.g. 1) to get the good branch to flash

Note: it is helpful to actually understand how the function works. e.g., if a debugger is present this function will return XX, otherwise it will return YY. That way you're not arbitrarily modifying values... you can do so with intention.

Hope this helps!

0

Use an "anti-anti-debugger" plugin (like ScyllaHide), which simply injects code into IsDebuggerPresent, yes that's possible, since each executable loads API separetly into RAM, which's one of reasons why newer Chrome versions eat RAM (each tab is a process).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.