9

What impact does noninvasive user mode debugging with WinDbg have on the process? Will it be detectable by the process?

Of course I could imagine that if the threads are suspended, differences in execution time of a function could be detected by comparing to "usual" values.

Microsoft itself does not indicate more impact than suspending threads. Is that true?

8

It is effectively true that there is no additional impact. Non-invasive debugging is simply suspending the process, and then reading the register context and memory. Since there are no alterations to the memory, there isn't any physical thing to detect. The timing discrepancies that it introduces are detectable, but the same effects can be produced by a system under heavy load, so the detection is unreliable for that reason (though the author of the detection routine might not care).

However, the very presence of an active debugger anywhere on the system is detectable, independently of the method used to debug. The non-invasive debugging technique simply defeats some of the more common methods.

| improve this answer | |
1

Exception handling can also make a difference. I'm currently looking at some code which triggers exceptions causing program termination if run outside the debugger under the right circumstances. When the same happens inside the debugger, the exception handling is intercepted and the program behaves differently (it doesn't crash anymore but it also doesn't behave as if run outside the debugger).

| improve this answer | |
  • Exceptions should not make any difference, since the non-intrusive debugger won't see them. Plenty of applications behave differently in the presence of an attached debugger. The question is whether the application that you have behaves the same way without any debugger compared to the non-intrusive debugger (it should). If there's a difference, then perhaps the application detected the debugger. – peter ferrie Dec 16 '13 at 1:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.