2

I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every things on the screen are unresponsive, I can't click anything on the taskbar to switch to another application, I can't even press Alt+Tab to switch app. The only thing still working is the debugger.

Windbg is the worst case that it isn't even react to my mouse click when a breakpoint is hit, I have to use Task Manager to terminate the debugger along with the target app.

So, it's maybe some kind of anti-debugging technique? Does anyone know about this?

Debuggers that I use:

  • Visual Studio 2019 (works but everything else freeze)
  • x64dbg (works but everything else freeze)
  • Windbg (freezes along with the rest)
  • IDA Pro (freezes along with the rest).

1 Answer 1

1

I've had this with a few apps and found having the debuggee on a virtual desktop means I can just go back to the other virtual desktop and things are 100% normal

EDIT after re-reading, I'm not getting exactly that result (often with something like old versions of directx the screen can freeze and this helps)

Try debugging with ScyllaHide and a bunch of options turned on, AFAIK a lot of the anti debugger tricks will just crash outright but it's possible they've used a combination of NtSetInformationThread to block your debugger and then set up their own debugger to catch the int3 and freeze the system

2
  • 1
    Can you elaborate about "virtual desktop"? This is the first time I hear it. Commented Dec 27, 2021 at 14:53
  • Push windows key + tab and it opens up all your windows to choose from, there's a + button in the corner that creates another desktop and you can swap between them Commented Dec 28, 2021 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.