1

I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the works. The only problem is that I really need to get into it. The anti-debug stuff is mixed in all throughout the code with important computations that are used for the stuff I want to see. How could I start trying to spoof the measures so I can observe register usage unfoiled?

Improve this question

2 Answers 2

Reset to default
5

You can use something like Scylla Hide

https://github.com/nihilus/ScyllaHide

It has plugins for most popular debuggers. It has lots of hiding options and presets for advanced packers like Themida.

You can also try Titan Hide.

https://github.com/mrexodia/TitanHide

Improve this answer
4
  • My +1 vote for this one. I am not Olly fan, but this one obviously did the work for topicstarter. Well done :)
    – Denis Laskov
    Commented Sep 26, 2016 at 8:10
  • sorry, took a little break to recoup after that effort. This is flagged as best answer. Thank you!
    – codechao
    Commented Oct 3, 2016 at 3:28
  • The second link seems broken in the way that the repository was deleted
    – Thomas Weller
    Commented Jun 16, 2017 at 14:46
  • Updated link to new repo
    – Ghassan Idriss
    Commented Jun 16, 2017 at 18:27
1

I think, in such cases strategy is very depend on type of anti-debug mechanisms used, sort of computations that you are looking for, and amount of time you ready to spent on this task.

IMO you should follow this plan:

  1. statically analyse the binary [IDA] to map all those anti-debug features and points of interest you looking for.

  2. if possible, try to understand those important computations without actual file execution. you can re-create them in python, run them as separate binary or emulate them with, for example, pyEmu https://github.com/codypierce/pyemu

  3. if [2] was not successful, carefully make yourself thru each anti-debug feature during execution of binary under debugger. Use map you built in [1] to make it faster

Hope it helps :)

Improve this answer
4
  • 1
    Maybe Sylla hide or Titan hide may be of assistance here as well. Plugins for most debuggers are available.
    – Ghassan Idriss
    Commented Sep 25, 2016 at 1:29
  • thanks this does help. I will try to start with that. Basically a string is created through modifications to the .data of the exe. I want to know the string that it generates. It might be possible to selectively nop all the anti-debug features, but there's a lot and they're prolific, and usually around critical code.
    – codechao
    Commented Sep 25, 2016 at 8:29
  • I wish I could upvote you 1000 times @GhassanIdriss but I can't even once, because it was just a comment. Those two in conjunction worked where others didn't! I was able to get the string generated fine using ODBG.
    – codechao
    Commented Sep 25, 2016 at 10:47
  • I made an answer for it
    – Ghassan Idriss
    Commented Sep 25, 2016 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.