12

Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly on Windows 7. I could use the XP machine via RDP but my Win 7 machine is much less irritating to use.

Does anybody have any suggestions?

  • You could have a look at uberstealth and fix/adapt its source code. – newgre Jan 19 '14 at 22:05
14

I'm not sure if it's still around, but Themida used to have a kernel-mode driver component that facilitated some of the protection features. It could well be installed on your system and catching the debugger out.

My first suggestion would be to try Immunity Debugger. It's an Olly fork that is designed for offensive debugging and exploit development, but it might have a different enough codebase and enough anti-anti-debug stuff built in to help.

Alternatively, you could use Cheat Engine along with its DBVM kernel-mode module. It's usually used for cheating in games, but CE actually has a very fully featured debugger and some nice stealth features. The driver component re-implements a bunch of core Windows APIs, such as OpenProcess.

If the kernel-mode driver isn't still around, then it may well just be something like the OutputDebugString trick causing the crash. If the target is using TLS callbacks to execute code before WinMain, it might crash the debugger before you get to it. You could try editing Olly's options so that it breaks on the system entry point rather than WinMain.

  • 1
    You managed to read me like a book; I'm actually hacking the popular online MMO, MapleStory. I need a debugger to find its CRC check methods and detour them. I did not know about the DBVM module, it works like a charm - breakpoints and all! CE's debugger confuses me a bit, but I'm learning slowly. Thank you thank you thank you though, MS has no idea CE is attached. One nasty thing happened the first time I attached though. I BSOD'd; this happened with Olly once too. I think it's an anti-anti-debug method; BSOD message was BAD ACCESS/segfault. – David S. Jan 20 '14 at 14:00
  • Heh, I remember MapleStory hacks... back in the day I used to hang out with the guys who wrote the original gravity and vacuum hacks for it. Incredibly poor design for a multiplayer game. – Polynomial Jan 20 '14 at 14:47
  • The security has gotten better only because Themida has gotten better. It is neigh-impossible to properly unpack the new version of Themida with its CISC VM. You can unpack it, rather, LCF-AT has some ODBGscripts to help, but getting it to run is a different story. :( – David S. Jan 20 '14 at 16:54
  • I think they just skipped all that and went straight for in-memory patching and crash analysis to work out how to bypass their integrity checks. – Polynomial Jan 20 '14 at 17:55
  • @Polynomial: curious about the statement of Immunity being a fork of OllyDbg. Was OllyDbg FLOSS at some point, so it could be forked? – 0xC0000022L Jan 20 '14 at 18:32
3

You could try TitanHide. It is a kernel-mode hiding driver for both x86 and x64 OSses. It has the following features:

- ProcessDebugFlags (NtQueryInformationProcess)
- ProcessDebugPort (NtQueryInformationProcess)
- ProcessDebugObjectHandle (NtQueryInformationProcess)
- DebugObject (NtQueryObject)
- SystemKernelDebuggerInformation (NtQuerySystemInformation)
- NtClose (STATUS_INVALID_HANDLE exception)
- ThreadHideFromDebugger (NtSetInformationThread)

TitanHide is open-source and it's relatively easy to add new hooks. Notice that you need to disable PatchGuard and driver signing for it to work correctly on an x64 OS. Take a look here for more information.

Edit: I would like to point out that TitanHide is no longer maintained and not recommended for use in production environments. Always use a VM. For simple applications I would also recommend ScyllaHide

  • Your link fyyre.ivory-tower.de is dead.. – SIslam Feb 13 '16 at 9:09
  • 1
    Here is the archived link: https://web.archive.org/web/*/fyyre.ivory-tower.de – mrexodia Feb 13 '16 at 19:55
1

It might be a special case, but if you're on Windows 7 x64, take a look at Stealth64. It usually works fine for everything I throw at it.

1

You should try ScyllaHide. This is an open-source, actively developed anti-anti debug plugin. There are many hiding options in it.

0

I'd suggest taking a look at x64dbg. Despite what the dumb name might suggest, there is a 32 bit version. With that out of the way, I would give ScyllaHide a try.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.