1

I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any problems.

To bypass the checks I've encountered so far, I have a process of ~15 actions of setting breakpoints, stepping over instructions, skipping syscalls under certain conditions, etc, and it takes at least a couple of minutes to get up to the point where I left off.

Since doing this stuff manually is time-consuming and error-prone, I'd like to automate it.

I was thinking of building a C++ application that will launch the executable, attach and bypass all of the checks I've solved so far, then suspend the program and detach, so that I can attach with x64dbg and resume my reversing... or perhaps it's a better idea to do this with an x64dbg plugin? What's the best way to do this?

  • A very simple solution for targets like this is using a virtual machine, bypass all the checks manually then take a snapshot. Not trying to be snarky, I typically do that when simple binary patching won't do. That may lead to additional problems with VM detection, and if the target is a game this usually doesn't work at all, of course. – Johann Aydinbas Sep 4 '18 at 16:50
  • @JohannAydinbas that's a great idea, I hadn't thought of that. Why wouldn't this work for a game though? – P. Private Sep 5 '18 at 2:27
  • Performance and graphics. I know VirtualBox for example has experimental 3D support but I always assumed it's barely working for modern games. If it were any good everyone would just play their Windows games in a VM but that's not the case so I guess it's not working that good. – Johann Aydinbas Sep 6 '18 at 10:49
2

What you could do:

  1. With each found anti-debug, patch the exe with the bypass and continue with the patched one.

  2. If your debugger is scriptable (like e.g. Ida) run it under the script, insert breakpoints in your script and bypass the anti-debug in your script. This is a particularly useful in "dynamic" anti-debug cases where static patching is not possible or difficult.

The latter method is similar to your C++ idea, but more flexible as you can work completely in the debugger.

  • Thanks, I was able to automate everything I was doing manually in x64dbg. (as long as I stayed away from the buggy page guard breakpoints). – P. Private Aug 30 '18 at 8:33
0

You don't need any external plugin, this is already a builtin feature in x64dbg:

enter image description here

  • this likely covers only a few simplest checks. I doubt it will work against more advanced detection. – Igor Skochinsky Aug 29 '18 at 17:28
  • Fair enough, i've posted it as it's worked good enough to me with some few dozens of protections. But you're right, they were probably using some basic anti-debugging techniques. Anyway, the author tagged the question with x64dbg, so... worth to mention it :) – BPL Aug 29 '18 at 19:25
  • @BPL, thanks for your answer. Unfortunately the unpacker is way more advanced than that. – P. Private Aug 30 '18 at 2:39
  • @P.Private Sure thing, what Igor said above is definitely true... in any case, this is one of the first methods I tend to use to bypass the first protection layers of the analized software. – BPL Aug 30 '18 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.