0

What are some things I can do to do anti kernel debugging from user-mode C++?

I already use ZwQuerySystemInformation to query for SystemKernelDebuggerInformation.

Improve this question
2
  • I don't think it is feasible to control running environment, user mode program only has interfaces controlled by kernel. Theoretically a kernel debugging program can change anything.
    – Kerim Can Kalıpcıoğlu
    Jul 22, 2017 at 6:36
  • What does "do anti" even mean? Do you want to detect kernel debugging? Prevent? Interfere with? What do you want? What is your question?
    – conio
    Sep 4, 2017 at 13:10

1 Answer 1

Reset to default
3

There is little you can do to prevent/detect kernel mode debugging of your application from user mode. Even if you can detect, it's because no one is interested enough to by-pass them.

For example, your technique will be by-passed by hooking ZwQuerySystemInformation in the kernel to fool your checks.

If you want protection, you should invest into techniques that make the analysis/reversing harder (code protectors).

Just for reference, the opposite question.

Improve this answer
5
  • I agree with you to an extent. Since there aren't many solutions to usermode anti debugging, I have seen a lot of kernel mode debuggers make mistakes. Make mistakes that don't really matter to the standard program, so they are never fixed, but these mistakes can be detected. I am looking for a solution against most kernel debuggers, the ones that make the most mistakes. Thank you, however.
    – Rob Gates
    Jul 22, 2017 at 18:56
  • 1
    The question is who you want to defend yourself from? Debuggers are not doing any work by themselves, you know? And the second question, what is it that you are defending?
    – PhoeniX
    Jul 22, 2017 at 22:01
  • @RobGates, I'm aware of only one kernel debugger for Windows - the one integrated into the kernel. What other debuggers are there?
    – conio
    Sep 4, 2017 at 13:09
  • There are several - windbg, syser
    – PhoeniX
    Sep 4, 2017 at 13:53
  • There is only one - KD, regardless of which front-end you use it with. Syser is long dead. It's as relevant as SoftICE, "rr0d", etc. which is to say - completely irrelevant.
    – conio
    Sep 4, 2017 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.