ollydbg using notes (19)

ollydbg using notes (19)

Reference

Book: "Encryption and decryption"

Video: Small Turtle decryption Series video

anti-Debug

Let's take a look at these four programs. (: Http://pan.baidu.com/s/1pJCzABp)

They run without problems on their own, both display the registered information "you really did it! Congratz it ", but one to OD run will appear unregistered or error.

All four programs counter-debug the Od.

They all use the Isdebuggerpresent API function to determine if the program was called by the debugger.

You can see the REVERSEME.A program first, the normal operation will appear "you really did it! Congratz it "window, but the OD run will appear" KeyFile is not valid. Sorry. " Window. OD loader, F8 Single step, can find call 004010FB generated unregistered window.

Picture 1

In the call 004010FB breakpoint, the program runs the program, press F7 to enter call 004010FB, view the 004010FB code:

Picture 2

The function isdebuggerpresent This API to determine whether to use the OD mode program, if EAX = 1,je short 004010E2 implementation jump, resulting in "keyfile is not valid. Sorry. " Window. Reverse debugging can be removed by simply changing the JE short 004010E2 to NOP. The other three reverseme are similar.

Take a look at Debugger detected this program (: http://pan.baidu.com/s/1WuD4), if you do not use the English OD open it, press verify will appear "Debugger not detected!!" window; If you open it in English od it will produce an error window that says "Your debugger is detected!!!".

Open it in English OD, you can see the beginning of the program is a Dialogboxparama function to create modal dialog box.

Picture 3

0040108C is the process function of this modal dialog box.

at 0040108C Breakpoint, press F9 to run to 0040108C, press F8 to step through debugging.

You can see that when you run 0040108C for the second time, the error window will be generated at call    004011CB. In call    004011CB breakpoint, rerun, follow up.

call    004011CB is actually looking at all the processes in the current system, searching for the existence of all processes called" ollydbg. EXE "process, if any, generates the error window.

Picture 4

ollydbg using notes (19)