If it is debugged, this function returns a nonzero value, otherwise return value is zero. Continue for Olly to execute this API and stop at the RETN command by pressing Ctrl + F9:You can see that the contents of the EAX register have changed by looking at the registers window.As result of EAX by 1, this crack has been confirmed to be debugged by the debugger. And result:As you can see here, crackme not run and it ist terminate.Īs we explained earlier, if you fix the EAX value by 0, the crack will be debugged and not teminated.

Now restart OllyDbg and find out why we are terminate.There is a very popular and commonly used method detect debugger is using the IsDebuggerPresent API, so we will focus on the suspect at this function.We will try searching the list of APIs that crackme uses. Right-click and choose Search for > Name(or use Ctrl+N).Right-click the IsDebuggerPresent **API and select **Find references(Ctrl+R):So we know where to place the call to the IsDebuggerPresent API. Now let’s go!In this post, we will use crackme wirtten by RadASM.

You can download it in here.We can see, it not packed and code with assembly language. You can run crackme to see more detailed information. Go to Help -> AboutLoad crackme to Ollydbg(in this post i use OllgDbg v2.01):Try run Crackme. Exe file with cracked code, looks like OllyDbg sees the.If you are interested in learning how to use OllyDbg to understand how to reverse engineer or modify executables, DLL’s, etc, the tutorials at The Legend of Random are very well done.Reverse engineering with OllyDbg. Dealing with Visual Basic Binaries, Part 2.Also, I recommend using their custom packaged version of OllyDbg which includes many useful plugins already bundled in.

Dealing with Visual Basic Binaries, Part 1. About malware modification, hacking, security, programming, cracking, among many other things.

Ollydbg cracking