2

I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this. Can you guys please explain the setunhandledexceptionfilter() anti-debugging trick and how to overcome it in olly debugger?

Thanks in advance.

5

TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program.

A more detailed explanation

Here you can see the documentation for setunhandledexceptionfilter, reading it if you didn't already might make things clearer for you.

To make sure that user supplied function is called (see background for why) you should pass the exception to the program using olly. However, when you'll do that, the rest of the malware's code will execute from within the unhandled exception function and you'll lose control of the debugged program. To make sure you're still controlling the execution flow, you should place a breakpoint at the function passed as an argument to setunhandledexceptionfilter.

Some context and background

setunhandledexceptionfilter is used to set a user provided function as the function called when exception was not handled by any exception handler, just before the process is terminated. That function should be in charge of object cleanups and clean termination in the case of an unhandled exception.

There are several ways to use setunhandledexceptionfilter as an anti-debugging trick, but most will involve implementing a crucial part of the program inside the new unhandled exception handler, and then resume the rest of the code execution from within the exception handler.

  • still, i didn't get clear idea to handle the exception by manually using olly debugger. If you don't mind, pls give me the step by step explanation for handling the setunhandledexceptionfilter(). It will be very useful for me. I have entered the vtlink of my file here For ref:- "hxxps://www.virustotal.com/en/file/88e9568e6afc8cc82ac0ab7eea8b8fb4afa7edd20242043791488a070240a2ea/analysis/" Thanks.. – xoreax Apr 5 '17 at 12:16
  • 1
    Perhaps edit the question with the specific issue you have or what you're unable to do? – NirIzr Apr 5 '17 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.