1

I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the works. The only problem is that I really need to get into it. The anti-debug stuff is mixed in all throughout the code with important computations that are used for the stuff I want to see. How could I start trying to spoof the measures so I can observe register usage unfoiled?

5

You can use something like Scylla Hide

https://github.com/nihilus/ScyllaHide

It has plugins for most popular debuggers. It has lots of hiding options and presets for advanced packers like Themida.

You can also try Titan Hide.

https://github.com/mrexodia/TitanHide

| improve this answer | |
  • My +1 vote for this one. I am not Olly fan, but this one obviously did the work for topicstarter. Well done :) – Denis Laskov Sep 26 '16 at 8:10
  • sorry, took a little break to recoup after that effort. This is flagged as best answer. Thank you! – codechao Oct 3 '16 at 3:28
  • The second link seems broken in the way that the repository was deleted – Thomas Weller Jun 16 '17 at 14:46
  • Updated link to new repo – Ghassan Idriss Jun 16 '17 at 18:27
1

I think, in such cases strategy is very depend on type of anti-debug mechanisms used, sort of computations that you are looking for, and amount of time you ready to spent on this task.

IMO you should follow this plan:

  1. statically analyse the binary [IDA] to map all those anti-debug features and points of interest you looking for.

  2. if possible, try to understand those important computations without actual file execution. you can re-create them in python, run them as separate binary or emulate them with, for example, pyEmu https://github.com/codypierce/pyemu

  3. if [2] was not successful, carefully make yourself thru each anti-debug feature during execution of binary under debugger. Use map you built in [1] to make it faster

Hope it helps :)

| improve this answer | |
  • 1
    Maybe Sylla hide or Titan hide may be of assistance here as well. Plugins for most debuggers are available. – Ghassan Idriss Sep 25 '16 at 1:29
  • thanks this does help. I will try to start with that. Basically a string is created through modifications to the .data of the exe. I want to know the string that it generates. It might be possible to selectively nop all the anti-debug features, but there's a lot and they're prolific, and usually around critical code. – codechao Sep 25 '16 at 8:29
  • I wish I could upvote you 1000 times @GhassanIdriss but I can't even once, because it was just a comment. Those two in conjunction worked where others didn't! I was able to get the string generated fine using ODBG. – codechao Sep 25 '16 at 10:47
  • I made an answer for it – Ghassan Idriss Sep 25 '16 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.