Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
I don't think such a plugin currently exists. However, if you're willing to implement a minimal windbg backend, you could extend uberstealth, which unfortunately I've never come to finish as a project (actually I think anti-debugging is a dead anyway, but that's another story ;-)). It's essentially IDAStealth, but with all debugger specific functionality factored out (there's a backend for IDA and Olly2). All you'd have to do is write a backend for Windbg (and fix the remaining bugs, I could help you with that though), all other code is debugger independent. Should be less than a few dozen lines of code.
I am not sure if plugins exist but you can write simple scripts like below to hide WinDbg on case to case basis.
r?$t0 = (ntdll!_peb *) @$peb;?? @$t0->BeingDebugged;eb (@$t0+2) 0;?? @$t0->BeingDebugged
ZwSetInformationThread(XP SP3 syscalls with
bp ntdll!ZwSetInformationThread "r eip = $ip+0n12 ; r eax = 0; gc"
syntax similar to
ZwSetInformationThreadin addition you would also need to fakeout DebugPort to NULL with
ed poi(ADDRESS) 0
- Peter Ferrie's "Ultimate" Anti-Debugging Reference
You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use
InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you want a 64 bit process, replace every
- Extract ScyllaHide (download) anywhere;
NtApiTool\x86\PDBReaderx86.exeand when it's finished, copy
NtApiCollection.inito the same directory as
ScyllaTest_x86.exewith WinDbg (x86) you should be in
InjectorCLIx86.exe ScyllaTest_x86.exe HookLibraryx86.dll;
- Run (F5) in WinDbg.
Without using ScyllaHide:
When using ScyllaHide:
This process works for any debugger, if you feel like it you can even make an actual plugin for WinDbg. It should be quite easy.
I just added an option to inject to a process by process id. You can do this with:
InjectorCLIx86.exe pid:1234 HookLibraryx86.dll