How to prevent application from killing OllyDbg

Question

I want to run an OllyDbg and attach it to some starting later process.

But the problem is, that process is very aggressive: it kills OllyDbg on start, and I also can't run OllyDbg later because that process then crashes with some invective message written in some moonspeak language (there are symbols that can be read, and they tell something about 'antihack.dll', for which, though, I don't found any reference to using Dependency walker and Pe Explorer).

So, is there any way how to prevent this aggressive process from killing any working app and connect it somehow to OllyDbg?

P.S. Now is some crazy stuff going on. Even if rum without debugger in background process fails after some time with an memory access error (and I even replaced an .exe with the original one in case of some arbitrary overwrites).

Answer 1

What is the target program? Is it known to have an antihack? (If so, who makes it?) Are you on a 32-bit or 64-bit OS?

Use GMER/EnumDeviceDrivers()/etc and check for drivers that "antihack.dll" might be loading. If there is a driver, load its binary into IDA and start reversing, and if you're on 32-bit grab an anti-rootkit program (GMER, kernel detective, XueTr) and remove their hooks.

"they tell something about 'antihack.dll', for which, though, I don't found any reference to using Dependency walker and Pe Explorer"

Maybe the antihack.dll is loaded into a seperate process? Try monitoring process creation or just use taskmanager and see if there's a seperate process that is killing your Olly. Alternatively, it could just be a delayed LoadLibrary call. Also, the program might be injecting antihack.dll into your process instead of loading it (unlikely in this case).

If you're on a 32-bit OS, PhantOm with driver enabled should be enough to protect your Olly. If it isn't, try looking for other plugins that hide Olly. On a 64-bit OS, you would need to write your own driver, though with PatchGuard around even that will probably not be enough since they could be detecting your Olly by its window names/positions/hierarchy.

If you want to attach to a program with an antihack feature you would preferably partially or completely disable the antihack first. Stealthing an invasive debugger to get it to attach to an already running protected process is not a nice approach. Start with static analysis in IDA, find a way to start the program in Olly and debug the startup process, or start with less invasive dynamic analysis (Cheat Engine).