1

Im trying to bypass some trial functionnalities in os-monitor, the point is, after running it through ollydbg, a notification appears to tell that executable segment is encrypted with exe-packing algorithm.

enter image description here

I ignored that, and continue to execute it, then another notification said that program halted because a debugger is detected.

enter image description here

Can anyone enlighten me of what type of antidebugging technique is used in this software?

  • 1
    the first msgbox is from ollydbg warning that the exe is packed the second one is from the application and it may be using almost infinite varieties of antidebugging techniques. look for peter ferries paper on anti debugging techniques for an overview of antidebugging implementations that could be used in that software – blabb Jun 21 '15 at 21:31
  • @blabb which PE decryption tool you recommend me, in order to unpack this code? and how would i know which technique is used to prevent debugging. – Abr001am Jun 21 '15 at 21:47
  • there is no shortcut to deal with unknown your query is too broad to fit here – blabb Jun 21 '15 at 22:28
3

Can anyone enlighten me of what type of antidebugging technique is used in this software?

Yes, that Protection Error message is from ASProtect's unpacking stub.

From http://www.aspack.com/asprotect32.html, it features the following antidebugging techniques:

  • compression of the application
  • encryption of the application
  • counteraction to dumping application memory using tools like ProcDump
  • application integrity check
  • counteraction to debuggers and disassemblers
  • counteraction to memory patching
  • API for interaction between application and protection routines
  • creation and verification of registration keys using public keys encryption algorithms
  • keeping of the database and checkup of "stolen" (illegal) registration keys
  • possibility to create evaluation (trial) versions, that limit application functions based on evaluation time and the number of runs left
  • expose nag-screens
  • generating of registration keys, based on the specific computer system.

Not the answer you're looking for? Browse other questions tagged or ask your own question.