Programming Forums > Application Development > Assembly

lepricaun · Apr 17th, 2005, 6:12 AM

Hi All,

i'm trying to implement the following code in my program:

CheckDebug PROC

mov eax,dword ptr fs:[18h]
mov eax,dword ptr ds:[eax+30h]
movzx eax,byte ptr ds:[eax+2h]
ret
CheckDebug ENDP

unfortunately this doesn't work since the first line gives the error: "use of register assumed to ERROR", any ideas on how to fix this?

The code is exactly the same as IsDebuggerPresent() but i'm trying to use it without having a debugger recognizing it as such...

Thanks in advance!

lostcauz · Apr 17th, 2005, 3:00 PM

The crackme's are tough enough to reverse already..

I think using fs will be taking some risk since the OS sometimes uses this along with gs for seh. If you succeed in countering IsDebuggerPresent hooks with something unique I will be interested.

lepricaun · Apr 17th, 2005, 4:48 PM

you will be seeing them in my next crackits then

i've just released crackit_11, take a shot at it if you like, i've kept it really simple....

Apr 17th, 2005, 6:12 AM	#1
lepricaun Hobbyist Programmer Join Date: Aug 2004 Location: The Netherlands Posts: 111 Rep Power: 5	converting debugged assembly to masm asm Hi All, i'm trying to implement the following code in my program: (Toggle Plain Text) CheckDebug PROC mov eax,dword ptr fs:[18h] mov eax,dword ptr ds:[eax+30h] movzx eax,byte ptr ds:[eax+2h] ret CheckDebug ENDP CheckDebug PROC mov eax,dword ptr fs:[18h] mov eax,dword ptr ds:[eax+30h] movzx eax,byte ptr ds:[eax+2h] ret CheckDebug ENDP unfortunately this doesn't work since the first line gives the error: "use of register assumed to ERROR", any ideas on how to fix this? The code is exactly the same as IsDebuggerPresent() but i'm trying to use it without having a debugger recognizing it as such... Thanks in advance! __________________ http://www.white-scorpion.nl

Apr 17th, 2005, 3:00 PM	#2
lostcauz Hobbyist Programmer Join Date: Nov 2004 Location: 1691 miles East of L.A. Posts: 159 Rep Power: 5	The crackme's are tough enough to reverse already.. I think using fs will be taking some risk since the OS sometimes uses this along with gs for seh. If you succeed in countering IsDebuggerPresent hooks with something unique I will be interested. __________________ -- lostcauz Stepped in what?... Behind whose barn?... I didn't even know they had a cow!

Apr 17th, 2005, 4:48 PM	#3
lepricaun Hobbyist Programmer Join Date: Aug 2004 Location: The Netherlands Posts: 111 Rep Power: 5	you will be seeing them in my next crackits then i've just released crackit_11, take a shot at it if you like, i've kept it really simple.... __________________ http://www.white-scorpion.nl

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Programming Forums > Application Development > Assembly

converting debugged assembly to masm asm