Bypassing basic memory protection

Question

I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory.

But when I start to play the game and enter the game map, the game crash when the breakpoint triggered. And also, when I try to reattach the Cheat Engine, the memory cannot be read.

And when I go back to the main menu again, the protection is being turn off... I can view the memory, and debug again.

Any idea which on which function should add bp in order to trace this memory protection? I already add bp on the IsDebuggerPresent, but it doesn't trigger, so I'm pretty sure it's not the one..

Answer 1

At first try to start with hardware BP instead of software BP ("the regular ones") but remember that you only have 4 hardware BPs and they are per specific thread.

In addition, taking into account that you are saying

the memory cannot be read

then I would suggest

• to set BP on VirtualFree/NtFreeVirtualMemory and trace from there back to understand if memory was freed intentionally or because of some bug.
• if the above is not working, try to use hardware BPs on the same functions and also on GetThreadContext to check if there is anti-debugging present to clean the hardware BPs.

Answer 2

If you're using OllyDbg (Not OllyDbg 2), there are plugins that help fool the application into thinking it's not being debugged.

Check out the "Hide Debugger" plugin.

If that doesn't work, then you'll probably have to go in and figure out what it's doing by hand. You might want to try breaking once you hit start, and then doing some static analysis to figure out what's going on from that point. Best of luck!