I'm working on a sample that contains packing and anti-analysis measures.
Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried messing with this a bit) I am able to attach the debugger to the process but I am observing some behavior I haven't encountered before.
- Looking in x64dbgs
Memory Map
tab, the processes main memory segment is layed out differently to what I've seen in the past. Normally it is of typeIMG
and contains the usual.text
,.data
, etc memory segments. This samples main segment is of typeMAP
and doesn't contain the normal sections. Is this a technique? What is it called?
There are multiple segments in this sample, here is how they look:
Address=00004FF61EC70000
Size=0000000001EE0000
Page Information=malware_sample.exe
Allocation Type=MAP
Current Protection=ER---
Allocation Protection=ER---
Address=00004FF620B50000
Size=0000000000650000
Page Information=malware_sample.exe
Allocation Type=MAP
Current Protection=-RW--
Allocation Protection=-RW--
Address=00004FF6211A0000
Size=000000000013B000
Page Information=malware_sample.exe
Allocation Type=MAP
Current Protection=-R---
Allocation Protection=-R---
- When trying to set breakpoints or patch memory x64dbg fails on the first segment I listed. I am able to place breakpoints on the second segment so my guess is the protection is preventing breakpoints/patching (
Current Protection=ER---
)? - When trying to alter the protection of the memory segment in x64dbg using
Set Page Memory Rights
to test if that is the cause of the failure to patch/bps I get an error saying there was a failure to change the memory protection. What can cause this? Is there anti-debugging tricks to prevent changing memory protection?