6

A common anti-debugging practice is to overwrite functions such as DbgUiRemoteBreakin within ntdll.dll.

Since in-memory representation of common libraries is always the same on each platform, it should be possible for an external tool to connect to a process and compare in-memory library code with a reference in order to find any manipulations done by the process itself.

Does anybody know such a tool for Windows?

Improve this question
1

2 Answers 2

Reset to default
3

WinDbg can do this for Microsoft DLLs and executables (and generally for any code that can be obtained from the symbol server). Just attach the debugger to the process and do !chkimg <module>. It will download a clean copy of the module from the symbol server and compare it, reporting on differences.

This article has an example of the output you can expect to see when something has modified a binary.

Improve this answer
1
  • The described manipulation is usually used for terminating the process when an debugger is attached. Therefore only the variant by analyzing a process memory dump would be possible.
    – Robert
    Commented Jun 27, 2013 at 15:49
3

You can attach to the process non invasive and use !chkimg !chkallimg !chksym commands.

Look for non invasive check box in the attach to process dialog in windbg or use .attach -v "pid"

Attaching in a non invasive way minimizes debugger interference and in most cases will not trigger the anti-debugging routines.

Improve this answer
1
  • I was looking at your answers and saw that some of them were missing punctuation. I made some edits but in the future, please try to incorporate these into your answers as it makes them much more easier to read. Thanks!
    – asheeshr
    Commented Jun 28, 2013 at 2:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.