1

I am interested in the following technique to detect if a debugger is attached or not.

http://spareclockcycles.org/2012/02/14/stack-necromancy-defeating-debuggers-by-raising-the-dead/

However I tried the examples and they don't seem to work.

Do the Windows Debug API modify the debugee stack when they are attached or when they are present?

Thanks !

1 Answer 1

2

The results in the article rely on details which are specific to the version of Windows and to the debugger which is present at the time. They have not been documented widely because they are so unreliable.

Windows will inject a thread into an attached process in order to gather information about the process, which led to the "DebugBreak overwrite" technique to defeat it.

There are additional checks which are performed when a debugged process is launched, which can result in altered stack state, but the whole thing is just chasing ghosts. The behavior of Windows could be changed at any time to reintroduce the behavior or change it in yet other ways.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.