12

Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly on Windows 7. I could use the XP machine via RDP but my Win 7 machine is much less irritating to use.

Does anybody have any suggestions?

Improve this question
1
  • You could have a look at uberstealth and fix/adapt its source code.
    – newgre
    Jan 19, 2014 at 22:05

5 Answers 5

Reset to default
14

I'm not sure if it's still around, but Themida used to have a kernel-mode driver component that facilitated some of the protection features. It could well be installed on your system and catching the debugger out.

My first suggestion would be to try Immunity Debugger. It's an Olly fork that is designed for offensive debugging and exploit development, but it might have a different enough codebase and enough anti-anti-debug stuff built in to help.

Alternatively, you could use Cheat Engine along with its DBVM kernel-mode module. It's usually used for cheating in games, but CE actually has a very fully featured debugger and some nice stealth features. The driver component re-implements a bunch of core Windows APIs, such as OpenProcess.

If the kernel-mode driver isn't still around, then it may well just be something like the OutputDebugString trick causing the crash. If the target is using TLS callbacks to execute code before WinMain, it might crash the debugger before you get to it. You could try editing Olly's options so that it breaks on the system entry point rather than WinMain.

Improve this answer
7
  • 1
    You managed to read me like a book; I'm actually hacking the popular online MMO, MapleStory. I need a debugger to find its CRC check methods and detour them. I did not know about the DBVM module, it works like a charm - breakpoints and all! CE's debugger confuses me a bit, but I'm learning slowly. Thank you thank you thank you though, MS has no idea CE is attached. One nasty thing happened the first time I attached though. I BSOD'd; this happened with Olly once too. I think it's an anti-anti-debug method; BSOD message was BAD ACCESS/segfault.
    – David S.
    Jan 20, 2014 at 14:00
  • Heh, I remember MapleStory hacks... back in the day I used to hang out with the guys who wrote the original gravity and vacuum hacks for it. Incredibly poor design for a multiplayer game.
    – Polynomial
    Jan 20, 2014 at 14:47
  • The security has gotten better only because Themida has gotten better. It is neigh-impossible to properly unpack the new version of Themida with its CISC VM. You can unpack it, rather, LCF-AT has some ODBGscripts to help, but getting it to run is a different story. :(
    – David S.
    Jan 20, 2014 at 16:54
  • I think they just skipped all that and went straight for in-memory patching and crash analysis to work out how to bypass their integrity checks.
    – Polynomial
    Jan 20, 2014 at 17:55
  • @Polynomial: curious about the statement of Immunity being a fork of OllyDbg. Was OllyDbg FLOSS at some point, so it could be forked?
    – 0xC0000022L ♦
    Jan 20, 2014 at 18:32
3

You could try TitanHide. It is a kernel-mode hiding driver for both x86 and x64 OSses. It has the following features:

- ProcessDebugFlags (NtQueryInformationProcess)
- ProcessDebugPort (NtQueryInformationProcess)
- ProcessDebugObjectHandle (NtQueryInformationProcess)
- DebugObject (NtQueryObject)
- SystemKernelDebuggerInformation (NtQuerySystemInformation)
- NtClose (STATUS_INVALID_HANDLE exception)
- ThreadHideFromDebugger (NtSetInformationThread)

TitanHide is open-source and it's relatively easy to add new hooks. Notice that you need to disable PatchGuard and driver signing for it to work correctly on an x64 OS. Take a look here for more information.

Edit: I would like to point out that TitanHide is no longer maintained and not recommended for use in production environments. Always use a VM. For simple applications I would also recommend ScyllaHide

Improve this answer
2
  • Your link fyyre.ivory-tower.de is dead..
    – Learner
    Feb 13, 2016 at 9:09
  • 1
    Here is the archived link: https://web.archive.org/web/*/fyyre.ivory-tower.de
    – mrexodia
    Feb 13, 2016 at 19:55
1

It might be a special case, but if you're on Windows 7 x64, take a look at Stealth64. It usually works fine for everything I throw at it.

Improve this answer
1

You should try ScyllaHide. This is an open-source, actively developed anti-anti debug plugin. There are many hiding options in it.

Improve this answer
1

I'd suggest taking a look at x64dbg. Despite what the dumb name might suggest, there is a 32 bit version. With that out of the way, I would give ScyllaHide a try.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.