I'm working on a sample that contains packing and anti-analysis measures.
Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried messing with this a bit) I am able to attach the debugger to the process but I am observing some behavior I haven't encountered before.
- Looking in x64dbgs
Memory Maptab, the processes main memory segment is layed out differently to what I've seen in the past. Normally it is of type
IMGand contains the usual
.data, etc memory segments. This samples main segment is of type
MAPand doesn't contain the normal sections. Is this a technique? What is it called?
There are multiple segments in this sample, here is how they look:
Address=00004FF61EC70000 Size=0000000001EE0000 Page Information=malware_sample.exe Allocation Type=MAP Current Protection=ER--- Allocation Protection=ER--- Address=00004FF620B50000 Size=0000000000650000 Page Information=malware_sample.exe Allocation Type=MAP Current Protection=-RW-- Allocation Protection=-RW-- Address=00004FF6211A0000 Size=000000000013B000 Page Information=malware_sample.exe Allocation Type=MAP Current Protection=-R--- Allocation Protection=-R---
- When trying to set breakpoints or patch memory x64dbg fails on the first segment I listed. I am able to place breakpoints on the second segment so my guess is the protection is preventing breakpoints/patching (
- When trying to alter the protection of the memory segment in x64dbg using
Set Page Memory Rightsto test if that is the cause of the failure to patch/bps I get an error saying there was a failure to change the memory protection. What can cause this? Is there anti-debugging tricks to prevent changing memory protection?