Modifying PPID to avoid anti-debugging measure

Question

I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits.

To bypass this, I wrote a pycommand script. This script breaks at the end of (and before the pops and ret) Process32NextW and Process32FirstW. Below is the hook I'm using:

class Process32NextWHook(LogBpHook):

def __init__(self):
    LogBpHook.__init__(self)
    return

def run(self, regs):
    imm = immlib.Debugger()

    # Get the Out_ LPPROCESSENTRY32 lppe
    PROCESSENTRY32 = regs["EBP"] + 16

    # Get the DWORD th32ParentProcessID
    target_ppid = PROCESSENTRY32 + 24

    # Get the DWORD th32ProcessID
    target_pid = imm.readMemory(PROCESSENTRY32 + 12, 4)

    # Get the debugged process id
    self_pid = imm.getDebuggedPid()

    # If the target pid matches our pid
    if int(target_pid.encode("HEX"), 16) == self_pid:
        # Set our ppid to the pid of explorer.exe
        imm.writeMemory(target_ppid, explorer_pid)
        imm.log("[*] patch_ppid patched ppid!!")

    return

However the

if int(target_pid.encode("HEX"), 16) == self_pid:

Is never true. My guess is that I use the wrong offsets, but I don't know what the right offsets would be. I could simply patch out the anti-debug measure, but that wouldn't be much of a learning experience.

Thanks.

Answer 1

So after going through the existing immunity scripts and mona.py, I found out that you also need to unpack the readMemory return values. Working code:

class Process32NextWHook(LogBpHook):

def __init__(self, ppid):
    LogBpHook.__init__(self)
    self.new_ppid = ppid
    return

def run(self, regs):
    imm = immlib.Debugger()

    # Get the Out_ LPPROCESSENTRY32 lppe
    PROCESSENTRY32 = regs["EBP"] + 16

    # Get the DWORD th32ParentProcessID
    target_ppid = PROCESSENTRY32 + 28

    # Get the DWORD th32ProcessID
    target_pid = struct.unpack("<L", imm.readMemory(PROCESSENTRY32 + 12, 4))[0]

    # Get the debugged process id
    self_pid = imm.getDebuggedPid()

    # If the target pid matches our pid
    if target_pid == self_pid:
        # Set our ppid to the pid of explorer.exe
        imm.log("[*] patch_ppid patching ppid, Before: %d" % struct.unpack("<L", imm.readMemory(target_ppid, 4))[0])
        imm.writeMemory(target_ppid, self.new_ppid)
        imm.log("[*] patch_ppid Done patching, After: %d" % struct.unpack("<L", imm.readMemory(target_ppid, 4))[0])

    return

Feeling a bit stupid now, that I forgot something so basic. Oh well : )