2

I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any problems.

To bypass the checks I've encountered so far, I have a process of ~15 actions of setting breakpoints, stepping over instructions, skipping syscalls under certain conditions, etc, and it takes at least a couple of minutes to get up to the point where I left off.

Since doing this stuff manually is time-consuming and error-prone, I'd like to automate it.

I was thinking of building a C++ application that will launch the executable, attach and bypass all of the checks I've solved so far, then suspend the program and detach, so that I can attach with x64dbg and resume my reversing... or perhaps it's a better idea to do this with an x64dbg plugin? What's the best way to do this?

Improve this question
3
  • A very simple solution for targets like this is using a virtual machine, bypass all the checks manually then take a snapshot. Not trying to be snarky, I typically do that when simple binary patching won't do. That may lead to additional problems with VM detection, and if the target is a game this usually doesn't work at all, of course.
    – Johann Aydinbas
    Commented Sep 4, 2018 at 16:50
  • @JohannAydinbas that's a great idea, I hadn't thought of that. Why wouldn't this work for a game though?
    – P. Private
    Commented Sep 5, 2018 at 2:27
  • Performance and graphics. I know VirtualBox for example has experimental 3D support but I always assumed it's barely working for modern games. If it were any good everyone would just play their Windows games in a VM but that's not the case so I guess it's not working that good.
    – Johann Aydinbas
    Commented Sep 6, 2018 at 10:49

2 Answers 2

Reset to default
5

What you could do:

  1. With each found anti-debug, patch the exe with the bypass and continue with the patched one.

  2. If your debugger is scriptable (like e.g. Ida) run it under the script, insert breakpoints in your script and bypass the anti-debug in your script. This is a particularly useful in "dynamic" anti-debug cases where static patching is not possible or difficult.

The latter method is similar to your C++ idea, but more flexible as you can work completely in the debugger.

Improve this answer
1
  • Thanks, I was able to automate everything I was doing manually in x64dbg. (as long as I stayed away from the buggy page guard breakpoints).
    – P. Private
    Commented Aug 30, 2018 at 8:33
2

You don't need any external plugin, this is already a builtin feature in x64dbg:

enter image description here

Improve this answer
4
  • this likely covers only a few simplest checks. I doubt it will work against more advanced detection.
    – Igor Skochinsky ♦
    Commented Aug 29, 2018 at 17:28
  • Fair enough, i've posted it as it's worked good enough to me with some few dozens of protections. But you're right, they were probably using some basic anti-debugging techniques. Anyway, the author tagged the question with x64dbg, so... worth to mention it :)
    – BPL
    Commented Aug 29, 2018 at 19:25
  • @BPL, thanks for your answer. Unfortunately the unpacker is way more advanced than that.
    – P. Private
    Commented Aug 30, 2018 at 2:39
  • @P.Private Sure thing, what Igor said above is definitely true... in any case, this is one of the first methods I tend to use to bypass the first protection layers of the analized software.
    – BPL
    Commented Aug 30, 2018 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.