5

Sometimes I've tried to attach Ollydbg to applications those have some protection against debuggers, but I have never coded any of these applications and did not see this protection in many applications... So it looks like it is not hard to bypass this, however I am curious and never tried it before. How do you do it guys? (at least some examples on some simple program).

Thanks in advance.

  • What kind of anti-debug protection are you refering to ? Testing ptrace can only be done with a test which will be localized in the code. And, I am not sure that attaching to a running software will cause a 0xcc to be written (does it?). So, self-check routine to detect modification of the source code will fail as wel.. My guess is that you just need to be lucky when you attach you debugger to the program and to stop it in a safe mode. – perror Nov 19 '13 at 20:55
  • Completely platform dependent. On windows, a common trick is to patch certain routines (in ntdll) that are invoked by the kernel as soon as the debugger is attached. A solution to this is to simply restore ntdll in memory right before attaching. I think this question is pretty borad, can you be more specific? – newgre Nov 19 '13 at 21:33
7

Anti-attaching depends heavily on the fact that windows creates a remote thread in the target process. What is specific about this thread is usually used to detect attaching.

For example: The entry point Windows chooses for the attaching thread is by default the "DbgUiRemoteBreakin" function. Anti-attaching tricks usually hook this function or its sibling, the "DbgBreakPoint" function.

Also, The fact that the attaching thread (like most normal threads) will have the associated TLS callbacks called is also exploited to detect attaching.

Debug blocks, NtContinue, ThreadHideFromDebugger etc.

http://waleedassar.blogspot.de/2011/12/debuggers-anti-attaching-techniques.html http://waleedassar.blogspot.de/2011/12/debuggers-anti-attaching-techniques_11.html http://waleedassar.blogspot.de/2011/12/debuggers-anti-attaching-techniques_13.html http://waleedassar.blogspot.de/2012/02/debuggers-anti-attaching-techniques_15.html http://waleedassar.blogspot.de/2012/11/sizeofstackreserve-as-anti-attaching.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.