Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
What impact does noninvasive user mode debugging with WinDbg have on the process? Will it be detectable by the process?
Of course I could imagine that if the threads are suspended, differences in execution time of a function could be detected by comparing to "usual" values.
Microsoft itself does not indicate more impact than suspending threads. Is that true?
It is effectively true that there is no additional impact. Non-invasive debugging is simply suspending the process, and then reading the register context and memory. Since there are no alterations to the memory, there isn't any physical thing to detect. The timing discrepancies that it introduces are detectable, but the same effects can be produced by a system under heavy load, so the detection is unreliable for that reason (though the author of the detection routine might not care).
However, the very presence of an active debugger anywhere on the system is detectable, independently of the method used to debug. The non-invasive debugging technique simply defeats some of the more common methods.
Exception handling can also make a difference. I'm currently looking at some code which triggers exceptions causing program termination if run outside the debugger under the right circumstances. When the same happens inside the debugger, the exception handling is intercepted and the program behaves differently (it doesn't crash anymore but it also doesn't behave as if run outside the debugger).
