Sometimes I've tried to attach Ollydbg to applications those have some protection against debuggers, but I have never coded any of these applications and did not see this protection in many applications... So it looks like it is not hard to bypass this, however I am curious and never tried it before. How do you do it guys? (at least some examples on some simple program).
Thanks in advance.
Anti-attaching depends heavily on the fact that windows creates a remote thread in the target process. What is specific about this thread is usually used to detect attaching.
For example: The entry point Windows chooses for the attaching thread is by default the "DbgUiRemoteBreakin" function. Anti-attaching tricks usually hook this function or its sibling, the "DbgBreakPoint" function.
Also, The fact that the attaching thread (like most normal threads) will have the associated TLS callbacks called is also exploited to detect attaching.
Debug blocks, NtContinue, ThreadHideFromDebugger etc.
http://waleedassar.blogspot.de/2011/12/debuggers-anti-attaching-techniques.html http://waleedassar.blogspot.de/2011/12/debuggers-anti-attaching-techniques_11.html http://waleedassar.blogspot.de/2011/12/debuggers-anti-attaching-techniques_13.html http://waleedassar.blogspot.de/2012/02/debuggers-anti-attaching-techniques_15.html http://waleedassar.blogspot.de/2012/11/sizeofstackreserve-as-anti-attaching.html
ptracecan only be done with a test which will be localized in the code. And, I am not sure that attaching to a running software will cause a0xccto be written (does it?). So, self-check routine to detect modification of the source code will fail as wel.. My guess is that you just need to be lucky when you attach you debugger to the program and to stop it in a safe mode.