2

I have a target application protected with CrypKey. When i try to attach to the apps in OllyDbg and Ida Pro i receive Unable to attach to this process.

The bad news is that i want to unpack the main exe after executing of Crypkey loader but after patching main exe and loader to obtain an infinite loop at the end of the code of the loader i am unable to attach to main exe and reach the OEP.

Do you know how or why i am unable to attack? A good solution in this cases?

Thank you very much

See image below:

enter image description here

Improve this question
2
  • You can find interesting anti-attach tricks here
    – 0xec
    Oct 11, 2014 at 15:27
  • Thank you i had see it but my case is different. The problem is that Crypkey loader is attached to main exe as ring 3 debugger. If i try to terminate Crypkey loader also the main exe will terminate. I am stucked here...
    – itseeder
    Oct 11, 2014 at 15:44

2 Answers 2

Reset to default
3

Debug the loader.

Set a breakpoint on CreateProcess (or ZwCreateProcess if needed)

When the breakpoint is hit modify the process creation flags on the stack to include CREATE_SUSPENDED. Make sure to remove any debugging related flags such as DEBUG_ONLY_THIS_PROCESS etc.

Single step over the CreateProcess call. At this point, the child process would be created in a suspended state. Now you should be able to attach a debugger to this.

Improve this answer
2
  • The main exe run the loader code that debub the main exe as ring 3 debugger so CreateProcess will be called to instantiate the loader and not the main exe. i am able to debug loader and see the int 3 opcode replaced at runtime in the main exe. At the end of this process i need to return to main exe and continue debugging to reach the OEP. I am unable to do it because the main exe refuse to be attached as process from any debugger. I hope that now the scenario it's more clear.
    – itseeder
    Oct 11, 2014 at 18:49
  • @Seed3Key So essentially you mean that the main exe spawns the loader process & the main exe cannot be debugged. If such is the case check whether you can attach to the main process before the loader process is created. If you cannot, then the main exe may well be debugging itself.
    – 0xec
    Oct 11, 2014 at 19:09
1

Use a anti-anti-debug plugin that supports "kill anti-attach" like ScyllaHide

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.