Log in

View Full Version : Not sure??


Teerayoot
October 22nd, 2003, 03:00
I have made some debuging on shareware program that limit day trial to 15 days.
That prog use commercial protection to protect itself.
It's packed and have antidebugging protect.
When i try to load them into Ollydbg ,it say "You must unload debugger first" (sorry if the word do not same exactly as report but it's invole about that)

even ,i already remove debugger flag (IsdebuggerPresent) api.
even i change ollyddg window class name and ollydbg window name.

But that prog still say "You must unload debugger first" .

i do not paste that program name here ,but his company have many software that use this commercial protector protect it.

Sorry for ungood englist grammar.
and sorry for too long that i have gone for this board ,
i am busy with making audio player that have some cracking protection .

Teerayoot ,reguard.

psyCK0
October 22nd, 2003, 07:20
Identify the commercial protection and remove it... There are numerous ways to detect a debugger, IsDebuggerPresent is only one of those.. Might be somthing like:
.xxx:00401044 mov ecx, large fs:30h
.xxx:0040104B test ecx, ecx
.xxx:0040104D js NO_DEBUGGER
Just one of the tricks...

Not a good forum for such questions I think... Try Woodmann's board for example...