8

I need and advice on how to start an analysis, connect with debugger to a process that is already debugging itself. Are there any tools/plugins/techniques that might help during the analysis?

UPDATE If I connect to the parent process with a debugger then I'll be able to see the Debug events that are being processed. How can I see/monitor what is going on in the child (debug-gee) process?

1

2 Answers 2

6
  1. Call NtSuspendProcess() on the child process.
  2. Inject code into the parent process to call DebugActiveProcessStop() on the child process.
  3. Attach your debugger to the child process.
  4. Call NtResumeProcess() on the child process.
1
  • Thanks! The problem is that removing the parent from the loop will break the logic chain as it is responsible for proper execution of the child. I'll update my first question.
    – PhoeniX
    Sep 30, 2013 at 18:51
2

After some hands on experience here what I can suggest regarding debugging self-debugging processes. Here I take the assumption that the self-debugging is implemented based on Windows Debug APIs. So, here are my findings:

In "debugger" process:

  • Attach/run with your debugger the process you want to study
  • Look for a call to CreateProcess API with the flags DEBUG_ONLY_THIS_PROCESS or DEBUG_PROCESS
  • Follow to the closest call to WaitForDebugEvent. Usually this will be a loop for processing of all the debug event that will come from the debug-gee.
  • Once the event processing region was found, all is needed is to check what event exactly is being processed. Check your event according to MSDN
  • In several cases there will be pair call to Get/SetThreadContext. So analyzing the structure before the SetThreadContext is called, one can actually see what region of the debug-gee was altered (if you did not know it already).
  • After all the alternations, there will be finally call to ContinueDebugEvent/ZwContinue. Until it was called the debug-gee is in freeze for the inspection.

In "debug-gee" process:

  • Attach WinDbg to it in non-invasive mode to inspect what was changed.
  • Make your notes before continue.

Hope this will help. Your comments are more than welcome.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.