1

I'm doing one of my first linux crackmes.

In the first blocks of code, it goes inside some anti-debug routine and inside one of those it forks and after it calls a waitpid routine. I can verify it and understand purely the code but I can't get why the creators put this code and how it can be an anti-debug technique. These are the interesting blocks.

Fork and Waitpid calls

  • This is impossible to tell if you don't show the rest of the code. There are lot of ways to implement an anti-debugger with a sub-process. – wisk Mar 7 at 18:23
  • Since it will be no-readable to screenshot other blocks of code, this is the executable I'm trying to analyze: dropbox.com/s/7oagp3scl54btob/reverse_me?dl=0 – Kartone Mar 7 at 18:40
1

Basically, the process calls fork, on the child side it'll try to attach a debugger to the parent process:

ptrace(PTRACE_ATTACH, getppid(), 0, 0);

If this syscall failed, it probably means a debugger is already attached to the parent process, this is your anti-debugger. To notify the parent process, the developer relies on the exit code. It's 1 if a debugger is attached, 0 otherwise.

On the parent side, it retrieves the exit code with the macro WEXITSTATUS. In C this is defined as:

#define WEXITSTATUS(x)  (_W_INT(x) >> 8)

Which gives in assembly:

sar     eax, 8
movzx   eax, al
test    eax, eax
jz      short no_debugger

This is another way to do a PTRACE_TRACEME. :)

  • Thanks, this is a great explanation. May I continue to ask your help in some other parts of this executable that are behind my actual comprehension? Do I need to open other threads? – Kartone Mar 8 at 9:42
  • Sure and it's up to you about creating another threads – wisk Mar 8 at 20:32
  • I was thinking, why you said that on the child side it'll try to attach a debugger to the parent process? After the fork(), if the JNZ instruction is false I would be into the child process, and the getpid() call would return the PID of the child, why the PID of the parent process? What am I missing? – Kartone Mar 13 at 22:55
  • The exectuable uses getppid(note the extra 'p') not getpid. The first function returns the PID of the parent process where the latter returns the current PID. – wisk Mar 13 at 22:58
  • OMG, how I missed it...sorry for the dumb question. -_- – Kartone Mar 13 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.