What are some things I can do to do anti kernel debugging from user-mode C++?
I already use ZwQuerySystemInformation to query for SystemKernelDebuggerInformation.
2
-
I don't think it is feasible to control running environment, user mode program only has interfaces controlled by kernel. Theoretically a kernel debugging program can change anything.– Kerim Can KalıpcıoğluJul 22, 2017 at 6:36
-
What does "do anti" even mean? Do you want to detect kernel debugging? Prevent? Interfere with? What do you want? What is your question?– conioSep 4, 2017 at 13:10
Add a comment
|
1 Answer
There is little you can do to prevent/detect kernel mode debugging of your application from user mode. Even if you can detect, it's because no one is interested enough to by-pass them.
For example, your technique will be by-passed by hooking ZwQuerySystemInformation in the kernel to fool your checks.
If you want protection, you should invest into techniques that make the analysis/reversing harder (code protectors).
Just for reference, the opposite question.
-
I agree with you to an extent. Since there aren't many solutions to usermode anti debugging, I have seen a lot of kernel mode debuggers make mistakes. Make mistakes that don't really matter to the standard program, so they are never fixed, but these mistakes can be detected. I am looking for a solution against most kernel debuggers, the ones that make the most mistakes. Thank you, however. Jul 22, 2017 at 18:56
-
1The question is who you want to defend yourself from? Debuggers are not doing any work by themselves, you know? And the second question, what is it that you are defending?– PhoeniXJul 22, 2017 at 22:01
-
@RobGates, I'm aware of only one kernel debugger for Windows - the one integrated into the kernel. What other debuggers are there?– conioSep 4, 2017 at 13:09
-
-
There is only one - KD, regardless of which front-end you use it with. Syser is long dead. It's as relevant as SoftICE, "rr0d", etc. which is to say - completely irrelevant.– conioSep 4, 2017 at 16:02