Log in

View Full Version : Safedisc (v1) and ollydbg


digitalmerlyn
July 19th, 2004, 22:53
I can't seem to get past the anti-debugger tricks in an older version of safedisc (v1.32.14 - I guess that's R4?) using OllyDBG.

Here is what I have tried so far:
1. changeing IsDebuggerPresent value
2. nop'ing "int 68" (which I'm not sure is even necessary)

I'm not sure what else to try. I've read quite a few tutorials on safedisc but all of the use softice. There are two things that the tutorials mention that I haven't tried:
1. hiding drivers (which is obviously SoftICE related and irrelavent in my case)
2. playing with the debug register


Regarding the debug register, it checks DR2 and NOT DR7. ArthaXerXes' safedisc tutorial mentions that the DR2 check doesn't seem to work. I've used IDA Pro to look at it and it seems, as he said, to not work correctly.

Any tips/recommendations as to which direction I should be heading in?

evlncrn8
July 21st, 2004, 10:12
artha's tut is flawed in some places, im pretty sure it was a dr7 check, and if i remember right, riscs tool decrypted v1's fine, so analyse his code, sd1 is simple u just need to decrypt it and rebuild the api calls, no need to debug it using olly.. oh yeh and use softice+icedump

Mr. Kaka
July 31st, 2004, 07:13
If you are running NT, the dr checks are located in the driver, secdrv.sys I think. Good luck.