Timeline for Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?
Current License: CC BY-SA 4.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Aug 8, 2021 at 11:31 | history | suggested | MarianD | CC BY-SA 4.0 |
Some fixes.
|
| Aug 8, 2021 at 10:52 | review | Suggested edits | |||
| S Aug 8, 2021 at 11:31 | |||||
| S Aug 8, 2021 at 7:44 | history | suggested | Glorfindel | CC BY-SA 4.0 |
typos corrected
|
| Aug 7, 2021 at 18:55 | review | Suggested edits | |||
| S Aug 8, 2021 at 7:44 | |||||
| Apr 16, 2020 at 11:01 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Dec 18, 2019 at 11:01 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Nov 18, 2019 at 10:23 | answer | added | Yotamz | timeline score: 2 | |
| May 20, 2017 at 15:58 | history | tweeted | twitter.com/StackReverseEng/status/865959969698525186 | ||
| Mar 16, 2015 at 7:13 | history | edited | 0xAK | CC BY-SA 3.0 |
Changed my whole question to be clearer
|
| Mar 12, 2015 at 9:56 | comment | added | 0xAK |
@GuntramBlohm, Wow yeah, ReadProcessMemory does happen! i would have never guessed that this API bypasses olly's memory breakpoints.. Always good to learn new things! Thought i have found that this API is called just before the crash happens in a new thread.. i logged all of the calls to ReadProcessMemory and the second parameter pBaseAddress is never even close to the memory i changed.. it must be something else or am i missing something?
|
|
| Mar 11, 2015 at 22:18 | comment | added | Guntram Blohm | At the end of the 2nd link, they say "N.B. ReadProcessMemory has also been used as a stealthy way to read memory without triggering Hardware Breakpoints." I'd assume that ReadProcessMemory copies the memory using kernel ring 0 mode, so it avoids the page restrictions that apply to user mode. Can't hurt to check if ReadProcessMemory gets called somewhere. | |
| Mar 11, 2015 at 15:43 | comment | added | 0xAK | i have just finished reading the articles you sent. though it makes no sense to me.. how come one time a memory breakpoint at the same place in the memory get executed, and the other time it wouldnt? Maybe this line of defense changing the Protection of the section and then changes it back? As i put a breakpoint in VirtualProtect \ VirtualProtectEX it doesnt seem to change the protection anywhere even close to the memory i have changed. also im not sure how ZwProtectVirtualMemory works or how the arguments are passed \ recieved | |
| Mar 11, 2015 at 14:22 | comment | added | 0xAK | @GuntramBlohm i added the additional information to my question | |
| Mar 11, 2015 at 14:20 | history | edited | 0xAK | CC BY-SA 3.0 |
additional information
|
| Mar 11, 2015 at 14:16 | comment | added | 0xAK | @GuntramBlohm I changed the byte dynamically only in the memory. not on the disk. I am using a Stealth plugin, the program does check if its being debugged or not. The program works good with a Stealth plugin in Olly and i can debug the program using Hardware Breakpoints (Normal breakpoints add Int 3) | |
| Mar 11, 2015 at 13:39 | comment | added | Guntram Blohm | And you might be interested in this which links to this. | |
| Mar 11, 2015 at 13:31 | comment | added | Guntram Blohm | Did you change the bytes on disk, or in memory only? The program might be reading its executable file. Also, some programs try to detect if they're running in a debugger. Did you install a Stealth plugin? Will the program work from Ollydbg if you don't patch anything? Or maybe the program detects memory breakpoints. Will the program work if you don't patch anything, but set a memory breakpoint anyway? | |
| Mar 11, 2015 at 13:23 | history | asked | 0xAK | CC BY-SA 3.0 |