ACCESS_VIOLATION when attaching a debugger

Question

I'm debugging a software and it hits access violation on wcslen function under debugger but runs normally without it.

First I thought It had some anti-debug trick, but I could not found any indicators of that in the executable, I also could not found any anti-debug technique with access violation.

I've tried using both x64dbg and windbgbut I had same problem on both of them. I also launched them with admin privileges since I thought privileges might be needed for something but error didn't go away.

Here is exact line of inside wcslen which causes this:

mov cx, word ptr ds:[eax]

and the address which eax points to is EF415351 which is pretty big.

So my question is, is there any anti-debug technique which involves access violation? How can I workaround this error?

Can I patch program so that it logs wcslen arguments, and then I'll just compare it's argument under debugger and normal execution and maybe find something interesting.

P.S I also get same error when launching application under debugger, so attaching or running under it doesn't make any difference.

Answer 1

is there any anti-debug technique which involves access violation? How can I workaround this error?

Yes, there is. It is called Structured Exception Handler for Windows. See this question, where I presented an implementation of such a technique.

Basically, it relies on the fact that, upon normal execution, when an excetion occurs, the control is transfered to the handler registered for such an exception and, as I illustrated in the question I gave a link to, it is possible to continue execution even, when normally program would crash. However, when run in a debugger, the exception is transfered to a debugger first, so the program doesn't receive it and behaves differently than when run without debugger attatched.

So, it is possible that the program you analyse, causes the error intentionally. In such a case, you should be able to pass the exception to the program after debugger receives it, so it behaves like debugger wasn't present (at least in theory).

Can I patch program so that it logs wcslen arguments, and then I'll just compare it's argument under debugger and normal execution and maybe find something interesting

Yes, you could do so. That will show you whether the arguments are the same or not in both cases.