2

I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows. It looks like the program has some sort of anti-debug protection. I have the following behavior:

  • If the program is running and I try to start x64dbg, x64dbg just won't start. Nothing happens.

  • If x64dbg is running and I try to start the program, the program starts and kills x64dbg immediately

    => because of this I am not able to attach x64dbg to the process

  • I also tried using File->Open in x64dbg. With this I can at least open the program. But the problem here is that when doing this the program immediately terminates.

As I am relatively new to this I really don't know what to do or where to go from here.

I hope some of you experienced guys can give me a solution or hint how I can debug this program. Thanks in advance!

Improve this question

1 Answer 1

Reset to default
2

This technique can occur in two ways, the first is through usermode, for example an application or an application module checks a snapshot of all processes in search of a blacklisted process or by debugger window patterns, in this first case you can rename the window and check if it will continue, the second way is to go to the folder of your program "that you want to attach" and check if it finds a kernel driver, you can detect it by its extension ".sys", in this second it is a little more complex the idea is almost the same but you need to patch the instructions responsible for checking the processes from RING 0, you can also try to use another debugger like Cutter for example that has x64 support if this is your architecture, see cutter aqui, see how ring zero, finally test some anti-anti-debugger as well TitanHide.

Improve this answer
6
  • Also check the protection, I may have already worked with it and can help with something by giving tips, for that use the DIE.
    – Happy
    Commented Feb 22, 2021 at 11:31
  • Thank you for the answer. Changing the window name did not work. Also there is no .sys or driver file in the program folder. I only have a .exe and a instructions.txt. I also tried Cutter. Didn't work either. So the last thing I did was trying TitanHide: I startet x64dbg and hid it with TitanHide. Unfortunately this didn't work either. As soon as I start my program x64dbg closes. It looks like somebody is trying really hard here with this program.
    – ne0n
    Commented Feb 22, 2021 at 15:38
  • One good news: With WinDbg I was at least able to start the program and WinDbg. I was also able to Attach WinDbg to the process. This didn't help much further because it seems as the process detaches itself from the debugger again after I hit run. Another strange thing I noticed. The file name of the program .exe changes after every run.
    – ne0n
    Commented Feb 22, 2021 at 15:46
  • Isn't it common for a commercial protector to be noisy like that, anti-virus would complain, are you sure you are debugging a program and not some malware? if possible could you attach some print of the executable sections? you can also analyze with IDA, update me if these new tips work, windbg is very good for analysis, but it is not normal for this type of thing to occur with a conventional process, you could also check if it has a digital signature (so anti-viruses do not complain about aggressive attitudes).
    – Happy
    Commented Feb 22, 2021 at 15:56
  • I'm pretty sure it's not malware, but I get that they have something to hide. It's a cheat program for a computer game. And I want to "hack the hack" ;) So if you will, it's not malware but it's also not a normal process thus having these advanced protection techniques that give me headache. I will try IDA. Will also attach some of the executable section shortly
    – ne0n
    Commented Feb 23, 2021 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.