How to bypass isDebuggerPresent with x64dbg

Question

I found a guide how to bypass it in ollydbg:

see here

But how to do that for an x64 application?

I have found following:

How must i manipulate this to don't get it detect the debugger?

score 2 · Answer 1 · answered Aug 22 '16 at 16:58

2

You can do it the same way as described in the guide (i.e. by patching the code of IsDebuggerPresent).

Or you can set a breakpoint at the "movzx eax, byte ptr ds:[rax+2]" instruction, and when the program stops at the breakpoint, go to RAX+2 in the Dump pane and then change the byte from 1 to 0.

answered Aug 22 '16 at 16:58

Alexander.K.Polyakov

51
2

But when I just do following: replace this function with mov rax, 0 mov eax, 0 -> still detecting the debugger somewhere ... – Martin Fischer Aug 22 '16 at 17:17
!! I found usage of CheckRemoteDebuggerPresent in the code. must i care about it,too? – Martin Fischer Aug 22 '16 at 17:55
Yes, probably. There are many ways to check if the program is being debugged. Read e.g. this: http://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/ – Alexander.K.Polyakov Aug 22 '16 at 19:25
So I Need to take care for all These possibly checks? – Martin Fischer Aug 23 '16 at 11:25
Generally speaking, yes. You can also try to use hiding plugins for x64dbg (TitanHide, ScyllaHide). – Alexander.K.Polyakov Aug 23 '16 at 13:01

How to bypass isDebuggerPresent with x64dbg

1 Answers1