Questions tagged [anti-debugging]

Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.

Filter by
Sorted by
Tagged with
0
votes
1answer
60 views

How can I detect if my application is running in x64debug?

I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response. When building the application, I am easily able to detect it is ...
1
vote
2answers
148 views

How to debug / analyze a Themida protected binary

Background: I have an application that has worked fine up until Windows 10 build 1511 but broke as of build 1607. It produces an access violation: STACK_TEXT: 03799f54 00f91cfa 24d1ae78 0000000f ...
0
votes
1answer
211 views

How to bypass anti-debugging C++

So I have a crackme my friend sent to try and crack it but the problem that I cannot bypass the anti-debugging or even patching it. I even tried using ScyllaHide at max settings but still it detects ...
1
vote
1answer
53 views

IDA Pro Debbuger is debugging the original code and not the patched code

Using IDA Pro, I tried to patch int 2Dh to nop. However, with the debugger, it seems that the original code is being loaded. What may be the reason for that? This might be related for some protections?...
0
votes
0answers
71 views

Bypass Javascript Debug Prevention in Firefox

I've looked around, and can't find an answer for my specific question. The closest I could find was this. I'm trying to reverse engineer some suspicious Javascript, but it repeatedly calls a debugger ...
2
votes
0answers
45 views

Anti-Reversing: Unable to patch memory/set breakpoints of process with x64, unusual memory segment

I'm working on a sample that contains packing and anti-analysis measures. Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried ...
0
votes
1answer
314 views

Program prevents x64dbg from starting or kills it if it's already running. What to do?

I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows. It looks like the program has some sort of anti-debug protection. I have the following behavior: ...
5
votes
1answer
527 views

Why does PE ImageBase address change in memory?

I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
1
vote
0answers
55 views

Debugged process not break on breakpoint

I launch a game process then I suspend the process and restore the hooks in ntdll.dll then I attach debugger to the process and resume the process. Next I see debugger catch the 0xC0000005(access ...
-1
votes
1answer
127 views

How can I analyze this code? [closed]

I wanted to analyse the code for some functionality. in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
-1
votes
1answer
81 views

Force debug Administrator Malware

I want to analyse a malware that do not run without administrative previliges. I know it is risky but still. How can I debug it with debugger as from entry point? Because debugger could not start ...
1
vote
0answers
177 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
2
votes
1answer
144 views

Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff

I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it. Pretext: ...
2
votes
1answer
215 views

Invalid file path error while trying to rebuild with apktool and aapt2

I am facing an error while try to repack an apk with apkool. below is the error trace. W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'. W: error: invalid file ...
0
votes
0answers
122 views

Anti-re tactics or radare problem while debugging

Here's the target application: https://www.sa-mp.com/download.php While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
0
votes
1answer
453 views

Android app crashes even while not edited, how can I solve it?

Installed an application from google playstore and then transferred to it my computer to apparently edit it and without any changes I made to it then I tried to install it through ADB, well the ...
1
vote
2answers
424 views

Finding call trace of a crashing executable with anti-debugging techniques

The application I target has terribly annoying anti-debugging techniques. With x32dbg and ScyllaHide with the following configuration, the application exits immediately as soon as a breakpoint is hit, ...
2
votes
1answer
270 views

Anti-debug clearing hardware breakpoints

An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg. I am observing the following behaviour: When placing the first hw breakpoint, it is ...
1
vote
1answer
325 views

Getting NTSTATUS 0xC0000022 when attempting to debug a process

I am attempting to debug a process with windbg (with admin privileges) and I am getting the following error: Could not attach to process XXXX =, NTSTATUS 0xC0000022 {Access Denied} A process has ...
1
vote
0answers
803 views

Pe file Vmp0 vmp1 section,

I have a PE file with section vmp0 vmp1, possible protected with VMProtect. I am using local debugger in IDA pro, the program will detect the debugger and pop-up an message box and quit , I used the ...
1
vote
2answers
162 views

How to solve this anti-disassembler trick?

I have this __asm instruction in C code: int func_0x8b4c55a0() { __asm { call $ +5 add[esp],5 ret } } int main() { char cVar1; if ((cVar1 = ...
0
votes
1answer
271 views

What is the usual way to determine if a Game uses KernelMode or UserMode Anti cheat?

How does one find out if a game uses KernelMode anti cheat or UserMode? For example the Game Black Desert Online uses Xigncode. If i google a bit about Xigncode i immediately find out that: "...
1
vote
0answers
41 views

Is it possible to define the adress of a function in assembly?

I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc. Here is the PoC program : BITS 32 EXTERN ...
0
votes
1answer
315 views

Advanced Anti-Debugging Techniques

I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like IsDebuggerPresent and CheckRemoteDebuggerPresent?
2
votes
0answers
551 views

How to virtualize part of a code like VMProtect does?

I am a new student in the field of cybersecurity. I would like to learn more about how virtualization used by software such as CodeVirtualizer and VMProtect works, and ideally to be able to ...
1
vote
1answer
762 views

anti-debugger techniques for shared library

I'm adding copyright protection to a demo version of a shared library. I've seem some recommendations to add timing around license violation detection codes -- which would be debugger + patch targets ...
1
vote
0answers
219 views

Process terminating when breakpoint reached

I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
2
votes
3answers
704 views

Debug program using peculiar anti-debugging technique

In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques. One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
-1
votes
1answer
621 views

Program closing even with IsDebuggerPresent Patched!

i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways. Steps i Followed ...
0
votes
1answer
4k views

Bypassing anti-debugging

I'm trying to RE Stardew Valley to write cheats for it. The problem is that when I trace the pointers for my health/energy/etc... back more than one level the game crashes. It probably has some kind ...
-2
votes
1answer
89 views

Can any one de-obfuscator this php code [closed]

my developer has changed all his contact info and i am unable to contact him and i want to move my site to another server but because of this obfuscator code in my php script i am unable to move my ...
1
vote
1answer
1k views

Anti-disassembler techniques and IDA Pro

I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having ...
1
vote
1answer
527 views

Fork and Waitpid calls in a CTF linux binary

I'm doing one of my first linux crackmes. In the first blocks of code, it goes inside some anti-debug routine and inside one of those it forks and after it calls a waitpid routine. I can verify it ...
3
votes
2answers
793 views

Jump in the middle trick

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
2
votes
1answer
319 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
1
vote
1answer
1k views

How int3 looks like in C

This is assembly code that can catch debugger with int 3 : MOV ECX, ExceptionHandler MOV DWORD PTR FS:[0], ExceptionHandler INT3 ///there is debugger!!! ExceptionHandler: ////no ...
2
votes
1answer
764 views

What is __sighandler_t struct and purpose of SIGTRAP signal handler

I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value : .text:08048063 ...
2
votes
1answer
283 views

dongle check happen before a debugger start debugging

i'm trying to fake the test ( dongle exist ) but one problem that i encounter is that the application detect it before i start debugging it . this is what happen with more details : open( not ...
3
votes
1answer
3k views

VMProtect anti-debug method

I recently found a nice crackme which uses VMProtect 3.x as defense. After doing a little research online I found couple of API's VMProtect uses as an anti debug method. I set software breakpoint on ...
1
vote
1answer
507 views

What is happening with these exceptions in OllyDbg?

I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
0
votes
1answer
573 views

Searching for a sequence of bytes in IDA

Using an hardware breakpoint, I found with Ollydbg that a crackme was checking for the isDebuggerPresent flag. I'd like to find this part of the code using IDA now. I first looked in the import table,...
4
votes
0answers
282 views

Instruction counting anti-debug

I recently came across this anti-debug technique being used in the wild. In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section A debugger will interfere ...
1
vote
0answers
307 views

debugger trap with angr

Let's suppose this (very ugly) c code: #include <stdio.h> #include <string.h> #include <signal.h> char sav_argv[100]; void on_sigtrap(int signo) { if (strcmp(sav_argv, "hello")...
2
votes
1answer
1k views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...
4
votes
1answer
2k views

Thread EntryPoint in TLS callback as AntiDebug technique

I came across a document called The Ultimate Anti-Reversing Reference, which describes various Anti-Debugging techniques. in point 4.Thread Local Storage There is a mention Thread Local Storage ...
1
vote
0answers
284 views

Failed to set breakpoint (Anti-debug protection)

Sorry for my bad English in advance. There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
2answers
5k views

How to skip on int 3 when ida debug?

I tried to debug a windows application, but when I debug it with Ida, it stopped on int 3 instruction. I read that int 3 catch debugger so I cant debug. How can I cancel this int 3? How call to int ...
4
votes
1answer
3k views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
0
votes
1answer
100 views

Cant debug software with ida [closed]

I have software that run on windows well. I tried to debug it with IDA (local win32 debug) but when I start it I see that exeption throw and I cant debug it. I dont use breakpoints Is that anti ...
-1
votes
1answer
1k views

VMProtect keygen, turn off the anti-debugging

who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....