0

What are some things I can do to do anti kernel debugging from user-mode C++?

I already use ZwQuerySystemInformation to query for SystemKernelDebuggerInformation.

  • I don't think it is feasible to control running environment, user mode program only has interfaces controlled by kernel. Theoretically a kernel debugging program can change anything. – de6f Jul 22 '17 at 6:36
  • What does "do anti" even mean? Do you want to detect kernel debugging? Prevent? Interfere with? What do you want? What is your question? – conio Sep 4 '17 at 13:10
3

There is little you can do to prevent/detect kernel mode debugging of your application from user mode. Even if you can detect, it's because no one is interested enough to by-pass them.

For example, your technique will be by-passed by hooking ZwQuerySystemInformation in the kernel to fool your checks.

If you want protection, you should invest into techniques that make the analysis/reversing harder (code protectors).

Just for reference, the opposite question.

  • I agree with you to an extent. Since there aren't many solutions to usermode anti debugging, I have seen a lot of kernel mode debuggers make mistakes. Make mistakes that don't really matter to the standard program, so they are never fixed, but these mistakes can be detected. I am looking for a solution against most kernel debuggers, the ones that make the most mistakes. Thank you, however. – Rob Gates Jul 22 '17 at 18:56
  • 1
    The question is who you want to defend yourself from? Debuggers are not doing any work by themselves, you know? And the second question, what is it that you are defending? – PhoeniX Jul 22 '17 at 22:01
  • @RobGates, I'm aware of only one kernel debugger for Windows - the one integrated into the kernel. What other debuggers are there? – conio Sep 4 '17 at 13:09
  • There are several - windbg, syser – PhoeniX Sep 4 '17 at 13:53
  • There is only one - KD, regardless of which front-end you use it with. Syser is long dead. It's as relevant as SoftICE, "rr0d", etc. which is to say - completely irrelevant. – conio Sep 4 '17 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.