Suppose you want to conceal an application's true purpose from analysts by reacting to dynamic analysis tools. How is it possible to detect running (in debugger mode) the application under a reverse engineering tool (e.g., IDA Pro) by the application itself? What code do you propose to use while preparing the application?


the easy answer:

probably a Sleep(random()*60000 + 10000) is more than enough to thwat most dynamic analysis systems. Or if((int)(random()*10) == 8) and so on

check for debuggers:

The 'standard' way is to use IsDebuggerPresent. But analysis systems are aware of that and try to patch these calls. So there are similar approaches checking the field in the EPROCESS structure directly. I've also seen malware checking the result of OutputDebugString.

check for analysis systems

Some malware families employ checks for certain process names implying the system may be used for analysis, like the pcap driver or the names of debugger-processes. Also, the availability of certain libraries may prevent the program from exhibiting its real behavior.

check for virtual environment

There are already lots of papers about this. Most dynamic analysis of potentially malicious programs happens in virtual environments. There are different approaches you can take here:

  • Timing traps - virtualization is slower than bare metal machines
  • Undefined behavior - often virtualization tools respond differently in error situations (e.g. invalid opcodes)
  • Suspicious strings - e.g. 'VirtualBox Harddrive', ...

Also, there are some very advanced approaches, like checking the behavior of the TLB.

  • Could you clarify what TLB is?
    – Martin
    Nov 18 '16 at 20:20
  • @Nordwald I actually did find the IsDebuggerPresent() routine in the assembly working with the DLL on IDA Pro. Regarding the random() in your answer, you meant rand()?
    – Newbie
    Nov 19 '16 at 11:11
  • @Martin This may be of help msdn.microsoft.com/en-us/library/windows/desktop/…
    – Newbie
    Nov 19 '16 at 11:15
  • I found a few useful links. They had overlaps so I'll copy the major one here. symantec.com/connect/articles/windows-anti-debug-reference
    – Newbie
    Nov 20 '16 at 15:59
  • 1
    @Martin TLB stands vor translation lookaside buffer and is an internal structure used by the CPU for caching physical addresses for virtual addresses
    – Nordwald
    Nov 24 '16 at 8:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.