Hello and welcome back.
As I mentioned in the earlier lesson on the introduction to A.T. buggy there are two methods mostly
used Ford Dee Dee Dee buggy on how to bypass key and debugging feature.
The first method is by patching which is to celebrate pine on the end to debugging API for example is
about the present and then patching it.
So in this lesson we show you how to use the first method to bypass the anti debugging feature.
So let's get started.
Your Chrome browser and look for him as the N is debugger present and press enter Hinkley on their first
visa.
Then you see
this is the API most commonly used in checking whether or not the software is attached to debugger and
he has no parameters but he retains a boolean value which can either be true or false.
So if the software he takes is that a debugger has been attached he will return true else it will return
false.
So let us now open the program.
If a debugger
click on run.
And then now click on run again to go to the entry point.
And now over here days have come online which you can type commands.
So the command to celebrate.
Pine can be used by typing BP full followed by the name of the symbol his new vulgar presence.
So just typing.
BP space is the the present.
So this is the API that we are putting a brake point on.
So it is a new method which we have not used before.
Previously we did it by using the mouse and click on the breakpoint but now we are typing using the
command blocks.
So after you have time this breakpoint is about the present.
Just press enter and you will see breakpoint head.
This address is set.
So now that be running taken run he will see here in three breakpoint.
So he has already found the reply because here and stop and you can see no.
This is the API is about present so yeah not in the user module we are in the system are you.
So if you remember in the earlier lessons I have taught you how to go back to using what do you still
remember yes.
So to go back to using more new you click on this button here run to use a code so just click on it
now and you will go back to the address in using module just after the call to the API.
So if you screw up now you see no account to the API was made here and he jumped to the system use a
new system address and now he comes back to the user more you.
So now we have detected this is the place where the call to the API is being made history by the present.
If you recall every API returns a value to be ex register the return value is in bool is a current process
is running in a context with Ivana and the return result.
He's gone 0 so over here
if you look at this so he returns there is up in X and he X is non-zero that means he has detected a
debugger if you press have enough to go here and you see he would press every now and you come to this
line you refined it he would not jump.
So if he doesn't dumb he will go to his pages message then you will have to die.
So you can see here
the Zero flag is not set because he X is not zero.
So he will 9 10.
So if you press heavy now he will enter and set up the message.
The bad message then he will call this are here.
He will show debugger delighted so now if you click
and then click on F nine to run he will be terminated debugging stuff.
Okay so now let's restart the program again and try the Apache let's run and now it has hit our very
fine a key run to use him good and screw up.
And now where do you think we should patch to causes me here.
The result is tiny X
so we actually attach only here to the junk will not be taken every press every time he saw that injury
is not taken.
So we want the junk to be taken.
So how do we take this issue make jam here to this address.
So take note of this address.
This address is 4 3 8 9.
So we wanted to jam here so that you and I showed the NSA and you will not call this function.
So as assembly here my double taking and modifying this to jam a checklist in issue and the size is
the same or less.
So he took the instructions the same size Leslie.
OK.
So now he will jam.
So now let's press Enter here jumped Navy press run and you see he has successfully bypassed the anti
debugging for DSA so now let's dash this survey.
So go to the file play batch file and then here click on page file and give it a name with a new suffix
batch sixty one special play close.
So now you can close these other
and open the page file with the debugger
get a run and if can run run again and you will see he had bypass the anti debugging feature so this
is how we perform the first method.
Oh and D can do debugging by using patching.
So thanks for watching.
In the next lesson I will show you how to use plugins to do the same thing.
See you then.
Bye bye.