3

This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app.

I tried using IDA to static analyze it, but it was written in a OOP language, and has many calls to pointers inside registers; so I keep getting stuck digging in.

So, I'm wondering if it's possible to patch the .exe with code above the calls to record the register values, and maybe the line of the instruction. and then I can see what functions/methods are being called.

I added a bunch of zero bytes to the end of the .exe, and it ran, so it doesn't seem to have any checksum verification.

Will this be possible?

  • 2
    You could try something like ScyllaHide for x64dbg. A lot of anti debugging tricks are covered by this plugin already. There's also a good text by Peter Ferrie "The Ultimate Anti-Debugging Reference". – defragger Nov 12 '18 at 16:44
  • i'm using that; I still can't get passed putting in break points, whenever I set a break point on a button, the software alerts me, and stopps executing..when I remove it, it works fine... – DeyMac Nov 12 '18 at 16:47
  • Right at the moment the breakpoint is hit or directly after setting it? – defragger Nov 12 '18 at 16:50
  • I set the break point at the beginning of a button click event, and the APP alerts me after I click the button, but it doesn't crash the app...I can remove the break point and the app continues as normal – DeyMac Nov 12 '18 at 17:10
  • it does the same for memory and hardware break points – DeyMac Nov 12 '18 at 17:12
0

I think CRC routine is inside code, maybe more than one for different part of code. It's not necessary checksum at the end of whole of file. For example its possible count sum of bytes and compare it with a value inside a register. Do you are debugging win32/64 or android file?

| improve this answer | |
  • what do you mean? I didn't ask about that, I asked if it would work in theory, if I were to patch the exe to add code to get register values at certain places – DeyMac Nov 13 '18 at 8:06
0
  1. I would try to determine the OOP language it was written there might be tools/IDA scripts to help with static analysis
  2. I have found the easiest way to reverse this kind of app is using time travel debugging trace (or similar) On Windows platform this is achieved by downloading WinDbg Preview from Windows 10 store. Once downloaded you can copy the files and run them without install to a machine without windows store if required. More info is available at Time Travel documentation. These traces once generated you can then step backwards/forwards instruction by instruction or to breakpoints.

For example I used this command to show the time travel position for all text written to a file I could then click the hyperlink generated to go to exact register/thread/memory state when that text was written to file

bp kernel32!WriteFile "!position;.printf \"%mu\",@rdx;g"

To go forwards use g command, to go backwards g-, to step single instruction forward t and step instruction backwards t-

  1. Also consider identifying the anti debugging technique used then hide from it, some examples here.
| improve this answer | |
0

It depends on what you are achieving:

  1. source code extraction (say to replicate it with minor modifications)
  2. program patching

For the first case, I normally try to use a non invasive debugger attached after suspending the process. If this does not work, I dump the whole process with SysInternals Process Explorer or WinDbg after suspending the process. The I use Ghidra do analyze the whole dump. I noted that IDA has issues in analyzing those dumps (sometimes peculiar parts are not detected) but you can combine them. This would give you the ability to analyze the code. If the code is self modifying you should use the second approach.

For the second case (and as last resort) I use a specially modified VM to remotely debug the application in non invasive mode. The VM is crafted with a custom rootkit that hides the processes you want (in particular, debuggers), this way you can debug the whole system in kernel mode without being detected.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.