I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits.
To bypass this, I wrote a pycommand script. This script breaks at the end of (and before the pops and ret) Process32NextW and Process32FirstW. Below is the hook I'm using:
class Process32NextWHook(LogBpHook): def __init__(self): LogBpHook.__init__(self) return def run(self, regs): imm = immlib.Debugger() # Get the Out_ LPPROCESSENTRY32 lppe PROCESSENTRY32 = regs["EBP"] + 16 # Get the DWORD th32ParentProcessID target_ppid = PROCESSENTRY32 + 24 # Get the DWORD th32ProcessID target_pid = imm.readMemory(PROCESSENTRY32 + 12, 4) # Get the debugged process id self_pid = imm.getDebuggedPid() # If the target pid matches our pid if int(target_pid.encode("HEX"), 16) == self_pid: # Set our ppid to the pid of explorer.exe imm.writeMemory(target_ppid, explorer_pid) imm.log("[*] patch_ppid patched ppid!!") return
if int(target_pid.encode("HEX"), 16) == self_pid:
Is never true. My guess is that I use the wrong offsets, but I don't know what the right offsets would be. I could simply patch out the anti-debug measure, but that wouldn't be much of a learning experience.