2

This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app.

I tried using IDA to static analyze it, but it was written in a OOP language, and has many calls to pointers inside registers; so I keep getting stuck digging in.

So, I'm wondering if it's possible to patch the .exe with code above the calls to record the register values, and maybe the line of the instruction. and then I can see what functions/methods are being called.

I added a bunch of zero bytes to the end of the .exe, and it ran, so it doesn't seem to have any checksum verification.

Will this be possible?

  • 2
    You could try something like ScyllaHide for x64dbg. A lot of anti debugging tricks are covered by this plugin already. There's also a good text by Peter Ferrie "The Ultimate Anti-Debugging Reference". – defragger Nov 12 '18 at 16:44
  • i'm using that; I still can't get passed putting in break points, whenever I set a break point on a button, the software alerts me, and stopps executing..when I remove it, it works fine... – DeyMac Nov 12 '18 at 16:47
  • Right at the moment the breakpoint is hit or directly after setting it? – defragger Nov 12 '18 at 16:50
  • I set the break point at the beginning of a button click event, and the APP alerts me after I click the button, but it doesn't crash the app...I can remove the break point and the app continues as normal – DeyMac Nov 12 '18 at 17:10
  • it does the same for memory and hardware break points – DeyMac Nov 12 '18 at 17:12
0

I think CRC routine is inside code, maybe more than one for different part of code. It's not necessary checksum at the end of whole of file. For example its possible count sum of bytes and compare it with a value inside a register. Do you are debugging win32/64 or android file?

  • what do you mean? I didn't ask about that, I asked if it would work in theory, if I were to patch the exe to add code to get register values at certain places – DeyMac Nov 13 '18 at 8:06
0

It would be probably possible to patch the executable if there is no checksum verification. But that would require a lot of effort.

So I would suggest you another approach instead. It's possible to detect anti-debugging checks in the code and bypass them. It's a broad topic, but I would recommend you an excellent source which will probably help you. That's a free course on cybrary platform (you have to register there, though), that elaborates on malware analysis and, in particular, anti-debugging techniques that can be used by software authors. Module 7 (Malware Defences) shows these and a complete process of bypassing them, so that you can analyse your program in a debugger.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.