how do I bypass ZwQueryInformationProcess as anti-debugging protection

Question

How do I defeat the ZwQueryInformationProcess() anti-debugging protection for the ProcessDebugPort class? Unlike isDebuggerPresent() I found this really hard to bypass in my skill...

Does anyone know how to bypass this api function?

Answer 1

#include "zwopenproc.h"
int main (void) 
{
    hNtdll=GetModuleHandle("ntdll.dll");
    if(hNtdll) 
    {
        *(FARPROC *)&ZwQIP  = GetProcAddress(hNtdll,"ZwQueryInformationProcess");
        hProc=OpenProcess(PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId());
        ZwQIP(hProc,ProcessImageFileName,OutBuff,sizeof(OutBuff),&Rlen);
        printf("ImageName=%wZ\n",OutBuff);
        ZwQIP(hProc,ProcessDebugPort,&DbgPort,4, &Rlen);
        switch( DbgPort )
        {
        case 0xffffffff:
            printf("some bugs are debugging us\n");
            break;
        case 0x0:
            printf("no bugs are debugging us\n");
            break;
        default:
            printf ("who knows if bugs are debugging us\n");
            break;
        }       
    }
    return 0;    
}

executing this code without debugger

zwopenproc.exe
ImageName=\Device\HarddiskVolume4\test\zwqiproc\zwopenproc.exe
no bugs are debugging us

executing inside debugger results in detection

cdb -g -G zwopenproc.exe | tail -2
ImageName=\Device\HarddiskVolume4\test\zwqiproc\zwopenproc.exe
some bugs are debugging us +++++++++++++++++++++++++++++++++++++++++++++++

executing inside debugger and overwriting the return buffer using a script results in no detection

cdb -G -c "$$>a< zwqip.txt" zwopenproc.exe  | tail -6


    Process Id  2064
    Parent Process  3716
    Base Priority 8
.  0    id: 810 create  name: zwopenproc.exe
ImageName=\Device\HarddiskVolume4\test\zwqiproc\zwopenproc.exe
no bugs are debugging us  <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

printf "%x\n" , 2064
810

contents of script file

cat zwqip.txt
bp ntdll!ZwQueryInformationProcess ".if( poi(@esp+8) != 7 ){gc} .else { !handle poi(@esp+4
) f ; | ; gu ; ed dbgport 0; gc } "
g