PDA

View Full Version : Problem/trick with kernel32 call


uad782
October 5th, 2008, 15:58
G'day,

I am playing with a target that has a timed licence which has now expired. When I run normally it brings up the message box that says it has expired etc with no problems.

However when I run in olly it crashes. I have traced to a call -GetSystemTimeAsFileTime. If I step through the call to this routine olly actually misses the call and gets some code just above it. When it finishes the call from the wrong location it has an incorrect return address causing olly to terminate.


If I break on the call and press enter I go to the call.

I am running olly (Diablo) and Olly 9in1.

Has anyone got any ideas please?

Thanks

dau

personmans
October 20th, 2008, 17:08
It's an anti-debugger. I'm not sure what else you were looking for, but chances are it's just detecting Olly, so you'll need to find a way of hiding it.