Help: Anti-Debug Techniques in use

[kickenchicken57]

Hi,

I have done some reversing before but I have never had to deal with any anti-debug techniques. I am using IDA Pro 5.2 debugger to try to set a breakpoint in WinMain and on the first line of the startup routine in an executable, but my breakpoints are never hit. The executable continues to run and the debugger is not detached either. I need some help figuring it out. One more note, when IDA Pro debugger starts the application I get the message "Rebasing program to 0xXXXXXXXX" a couple of times with different addresses each time. I believe that the startup code is dynamically calculating an address to call?

Here is a link to the executable if anyone is interested :

http://wiki.gbatemp.net/wiki/images/c/cf/V112_UpdaterTool.rar

Please help!

[kickenchicken57]

After further investigation it looks like the technique in use is a tls callback routine that has an invalid value in the TLS_DIRECTORY that is fixed during loading with base relocation on the executable. I am still having a little bit of trouble determining how to figure out where the real tls callback routine is located.