bypassing isDebuggerPresent WITHOUT changing mem

If you change the JE, you are modding the program code, and it no doubt detects this with a CRC routine of some sort. Also, if you wait until the code returns, and then change the value in eax, you are once again "modding" the code in a way because you are setting a breakpoint in the code.

The safest and most effective way to modify IsDebuggerPresent detection is to edit the Program's thread block. This is easy in OllyDbg. You can do this before the program even starts to run, after Olly loads it.

NOTE THIS example works for Windows 2000 / XP.

Open your program in OllyDbg. Note the value of the FS register. On my 2000 system, it's 7FFDE000. Go to the hex dump window in Olly (at the bottom) and right click and say Go To->Expression and type in this value.

Now, at FS[30], which would be 7FFDE030 on my machine (30 bytes in ) there is another address, this points to the program's thread environment block (TEB). Select this address in the window by clicking and selecting it, then right click and say "Follow DWORD in dump". This address by the way in my 2000 system is 7FFDF000.

Now, 3 bytes in you will see a 01. This is telling windows the program is being debugged. Change it to a zero by selecting it, and just start typing in zero, zero. Olly brings up the memory edit window, after entering the zeros just push ok and now you are hidden from the IsDebuggerPresent detector, and you didn't modify or edit any program memory or API memory. In fact, the program hasn't even started yet.

-nt20

- 출처 - http://www.woodmann.com/forum/archive/index.php/t-5875.html