When I attach OllyDbg or ImmunityDebugger to a process, it automatically breaks execution. I'm attaching to a user-mode service running as SYSTEM and only need to catch exceptions, so this is not ideal. Is there a way to disable the break-on-attach behaviour?
The break on attach is due to the
DbgBreakPoint functions being called. If you check the
DebugActiveProcess function called by the debugger, OllyDbg or ImmunityDebugger, you will see a call to the
ZwCreateThreadEx function depending on your OS.
So, i guess one way to bypass breaking is:
- debug the debugger itself
- go to the
DbgUiIssueRemoteBreakinfunction and spot the call to the function creating the remote thread.
- change the
lpStartAddressparameter in case of
I created an OllyDbg v1.10 plugin which
DbgBreakPoint in the process with the PID you choose. It has only been tested on Windows 7.
Place SilentAttach.dll in OllyDbg directory, fire OllyDbg, Press Alt+F12, and then enter process Id of the process you want to silently attach to.
N.B. Since no break occurs, OllyDbg does not extract many piece of info. e.g. list of loaded module. So, you have to activate the context by something like Alt+E then Alt+C
One way to do this is to have an OllyDbg plug-in that performs a
WriteProcessMemory(hDebuggee, GetProcAddress(GetModuleHandle("ntdll"), "DbgBreakPoint"), &mynop, 1, NULL)
where hDebuggee is the handle for the process being debugged (I believe that OllyDbg has an API for retrieving this value), and mynop is a variable that holds a 0x90 byte (nop instruction).
That will clear the int3 instruction that is causing the break, allowing the execution to continue immediately. It's a common anti-debugging trick.
I don't think this is possible without doing something extremely invasive. Either patching OllyDbg to use an alternative ZwXX/NtXX function which accepts some flags or patching the kernel. The initial break is done by the operating system so that the debugger can gather information about the process it is being attached to.
I haven't verified but my guess is that OllyDbg is calling DebugActiveProcess in order to attach to it. The documentation for it states:
After the system checks the process identifier and determines that a valid debugging attachment is being made, the function returns TRUE. Then the debugger is expected to wait for debugging events by using the WaitForDebugEvent function. The system suspends all threads in the process, and sends the debugger events that represents the current state of the process.
And later on
After all of this is done, the system resumes all threads in the process. When the first thread in the process resumes, it executes a breakpoint instruction that causes an EXCEPTION_DEBUG_EVENT debugging event to be sent to the debugger. All future debugging events are sent to the debugger by using the normal mechanism and rules.