How to Attach debugger or start analysis of process that is debugging itself?

Question

I need and advice on how to start an analysis, connect with debugger to a process that is already debugging itself. Are there any tools/plugins/techniques that might help during the analysis?

UPDATE If I connect to the parent process with a debugger then I'll be able to see the Debug events that are being processed. How can I see/monitor what is going on in the child (debug-gee) process?

Answer 1

1. Call NtSuspendProcess() on the child process.
2. Inject code into the parent process to call DebugActiveProcessStop() on the child process.
3. Attach your debugger to the child process.
4. Call NtResumeProcess() on the child process.

Answer 2

After some hands on experience here what I can suggest regarding debugging self-debugging processes. Here I take the assumption that the self-debugging is implemented based on Windows Debug APIs. So, here are my findings:

In "debugger" process:

• Attach/run with your debugger the process you want to study
• Look for a call to CreateProcess API with the flags DEBUG_ONLY_THIS_PROCESS or DEBUG_PROCESS
• Follow to the closest call to WaitForDebugEvent. Usually this will be a loop for processing of all the debug event that will come from the debug-gee.
• Once the event processing region was found, all is needed is to check what event exactly is being processed. Check your event according to MSDN
• In several cases there will be pair call to Get/SetThreadContext. So analyzing the structure before the SetThreadContext is called, one can actually see what region of the debug-gee was altered (if you did not know it already).
• After all the alternations, there will be finally call to ContinueDebugEvent/ZwContinue. Until it was called the debug-gee is in freeze for the inspection.

In "debug-gee" process:

• Attach WinDbg to it in non-invasive mode to inspect what was changed.
• Make your notes before continue.

Hope this will help. Your comments are more than welcome.