Questions tagged [anti-debugging]

Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.

Filter by
Sorted by
Tagged with
1 vote
1 answer
71 views

Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application

I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
user avatar
0 votes
1 answer
76 views

Is that message mean the program has an anti-debugger?

When trying to debug a program using the x64dbg and in a specific step, the following problem happens: Is that mean that the program has an anti-debugger? if not, why when debugging the program and ...
user avatar
  • 125
0 votes
0 answers
45 views

How can I retrieve dropped PE files from a dropper without the program necessary to execute the dropper?

I have a file (dll) that is a Cobalt Strike dropper based on the strings found inside. The file has an "entry0", and other general windows specific functions. The file appears to be ...
user avatar
  • 1
0 votes
1 answer
136 views

How can I detect if my application is running in x64debug?

I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response. When building the application, I am easily able to detect it is ...
user avatar
1 vote
2 answers
600 views

How to debug / analyze a Themida protected binary

Background: I have an application that has worked fine up until Windows 10 build 1511 but broke as of build 1607. It produces an access violation: STACK_TEXT: 03799f54 00f91cfa 24d1ae78 0000000f ...
user avatar
  • 2,908
0 votes
1 answer
516 views

How to bypass anti-debugging C++

So I have a crackme my friend sent to try and crack it but the problem that I cannot bypass the anti-debugging or even patching it. I even tried using ScyllaHide at max settings but still it detects ...
user avatar
1 vote
1 answer
126 views

IDA Pro Debbuger is debugging the original code and not the patched code

Using IDA Pro, I tried to patch int 2Dh to nop. However, with the debugger, it seems that the original code is being loaded. What may be the reason for that? This might be related for some protections?...
user avatar
0 votes
0 answers
132 views

Bypass Javascript Debug Prevention in Firefox

I've looked around, and can't find an answer for my specific question. The closest I could find was this. I'm trying to reverse engineer some suspicious Javascript, but it repeatedly calls a debugger ...
user avatar
  • 1
2 votes
0 answers
102 views

Anti-Reversing: Unable to patch memory/set breakpoints of process with x64, unusual memory segment

I'm working on a sample that contains packing and anti-analysis measures. Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried ...
user avatar
0 votes
1 answer
736 views

Program prevents x64dbg from starting or kills it if it's already running. What to do?

I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows. It looks like the program has some sort of anti-debug protection. I have the following behavior: ...
user avatar
  • 1
6 votes
1 answer
788 views

Why does PE ImageBase address change in memory?

I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
user avatar
  • 61
1 vote
0 answers
63 views

Debugged process not break on breakpoint

I launch a game process then I suspend the process and restore the hooks in ntdll.dll then I attach debugger to the process and resume the process. Next I see debugger catch the 0xC0000005(access ...
user avatar
-1 votes
1 answer
136 views

How can I analyze this code? [closed]

I wanted to analyse the code for some functionality. in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
user avatar
  • 179
-1 votes
1 answer
92 views

Force debug Administrator Malware

I want to analyse a malware that do not run without administrative previliges. I know it is risky but still. How can I debug it with debugger as from entry point? Because debugger could not start ...
user avatar
1 vote
1 answer
260 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
user avatar
  • 25
2 votes
1 answer
161 views

Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff

I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it. Pretext: ...
user avatar
2 votes
1 answer
255 views

Invalid file path error while trying to rebuild with apktool and aapt2

I am facing an error while try to repack an apk with apkool. below is the error trace. W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'. W: error: invalid file ...
user avatar
  • 179
0 votes
0 answers
148 views

Anti-re tactics or radare problem while debugging

Here's the target application: https://www.sa-mp.com/download.php While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
user avatar
  • 101
0 votes
1 answer
606 views

Android app crashes even while not edited, how can I solve it?

Installed an application from google playstore and then transferred to it my computer to apparently edit it and without any changes I made to it then I tried to install it through ADB, well the ...
user avatar
  • 179
1 vote
2 answers
477 views

Finding call trace of a crashing executable with anti-debugging techniques

The application I target has terribly annoying anti-debugging techniques. With x32dbg and ScyllaHide with the following configuration, the application exits immediately as soon as a breakpoint is hit, ...
user avatar
  • 111
2 votes
1 answer
362 views

Anti-debug clearing hardware breakpoints

An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg. I am observing the following behaviour: When placing the first hw breakpoint, it is ...
user avatar
1 vote
1 answer
460 views

Getting NTSTATUS 0xC0000022 when attempting to debug a process

I am attempting to debug a process with windbg (with admin privileges) and I am getting the following error: Could not attach to process XXXX =, NTSTATUS 0xC0000022 {Access Denied} A process has ...
user avatar
1 vote
0 answers
991 views

Pe file Vmp0 vmp1 section,

I have a PE file with section vmp0 vmp1, possible protected with VMProtect. I am using local debugger in IDA pro, the program will detect the debugger and pop-up an message box and quit , I used the ...
user avatar
1 vote
2 answers
189 views

How to solve this anti-disassembler trick?

I have this __asm instruction in C code: int func_0x8b4c55a0() { __asm { call $ +5 add[esp],5 ret } } int main() { char cVar1; if ((cVar1 = ...
user avatar
  • 111
0 votes
1 answer
292 views

What is the usual way to determine if a Game uses KernelMode or UserMode Anti cheat?

How does one find out if a game uses KernelMode anti cheat or UserMode? For example the Game Black Desert Online uses Xigncode. If i google a bit about Xigncode i immediately find out that: "...
user avatar
  • 113
1 vote
0 answers
47 views

Is it possible to define the adress of a function in assembly?

I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc. Here is the PoC program : BITS 32 EXTERN ...
user avatar
  • 261
0 votes
1 answer
355 views

Advanced Anti-Debugging Techniques

I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like IsDebuggerPresent and CheckRemoteDebuggerPresent?
user avatar
  • 103
2 votes
0 answers
622 views

How to virtualize part of a code like VMProtect does?

I am a new student in the field of cybersecurity. I would like to learn more about how virtualization used by software such as CodeVirtualizer and VMProtect works, and ideally to be able to ...
user avatar
1 vote
1 answer
854 views

anti-debugger techniques for shared library

I'm adding copyright protection to a demo version of a shared library. I've seem some recommendations to add timing around license violation detection codes -- which would be debugger + patch targets ...
user avatar
1 vote
0 answers
277 views

Process terminating when breakpoint reached

I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
user avatar
2 votes
3 answers
911 views

Debug program using peculiar anti-debugging technique

In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques. One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
user avatar
  • 3,179
-1 votes
1 answer
714 views

Program closing even with IsDebuggerPresent Patched!

i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways. Steps i Followed ...
user avatar
0 votes
1 answer
5k views

Bypassing anti-debugging

I'm trying to RE Stardew Valley to write cheats for it. The problem is that when I trace the pointers for my health/energy/etc... back more than one level the game crashes. It probably has some kind ...
user avatar
-2 votes
1 answer
96 views

Can any one de-obfuscator this php code [closed]

my developer has changed all his contact info and i am unable to contact him and i want to move my site to another server but because of this obfuscator code in my php script i am unable to move my ...
user avatar
  • 1
2 votes
1 answer
1k views

Anti-disassembler techniques and IDA Pro

I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having ...
user avatar
  • 151
1 vote
1 answer
590 views

Fork and Waitpid calls in a CTF linux binary

I'm doing one of my first linux crackmes. In the first blocks of code, it goes inside some anti-debug routine and inside one of those it forks and after it calls a waitpid routine. I can verify it ...
user avatar
  • 409
3 votes
2 answers
987 views

Jump in the middle trick

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
user avatar
2 votes
1 answer
420 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
user avatar
  • 221
1 vote
1 answer
1k views

How int3 looks like in C

This is assembly code that can catch debugger with int 3 : MOV ECX, ExceptionHandler MOV DWORD PTR FS:[0], ExceptionHandler INT3 ///there is debugger!!! ExceptionHandler: ////no ...
user avatar
2 votes
1 answer
1k views

What is __sighandler_t struct and purpose of SIGTRAP signal handler

I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value : .text:08048063 ...
user avatar
  • 261
2 votes
1 answer
334 views

dongle check happen before a debugger start debugging

i'm trying to fake the test ( dongle exist ) but one problem that i encounter is that the application detect it before i start debugging it . this is what happen with more details : open( not ...
user avatar
  • 21
3 votes
1 answer
3k views

VMProtect anti-debug method

I recently found a nice crackme which uses VMProtect 3.x as defense. After doing a little research online I found couple of API's VMProtect uses as an anti debug method. I set software breakpoint on ...
user avatar
  • 31
1 vote
1 answer
562 views

What is happening with these exceptions in OllyDbg?

I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
user avatar
  • 113
0 votes
1 answer
686 views

Searching for a sequence of bytes in IDA

Using an hardware breakpoint, I found with Ollydbg that a crackme was checking for the isDebuggerPresent flag. I'd like to find this part of the code using IDA now. I first looked in the import table,...
user avatar
  • 187
4 votes
0 answers
307 views

Instruction counting anti-debug

I recently came across this anti-debug technique being used in the wild. In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section A debugger will interfere ...
user avatar
1 vote
0 answers
338 views

debugger trap with angr

Let's suppose this (very ugly) c code: #include <stdio.h> #include <string.h> #include <signal.h> char sav_argv[100]; void on_sigtrap(int signo) { if (strcmp(sav_argv, "hello")...
user avatar
  • 583
2 votes
1 answer
1k views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...
user avatar
  • 23
4 votes
1 answer
3k views

Thread EntryPoint in TLS callback as AntiDebug technique

I came across a document called The Ultimate Anti-Reversing Reference, which describes various Anti-Debugging techniques. in point 4.Thread Local Storage There is a mention Thread Local Storage ...
user avatar
  • 153
1 vote
0 answers
337 views

Failed to set breakpoint (Anti-debug protection)

Sorry for my bad English in advance. There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
user avatar
  • 131
1 vote
2 answers
6k views

How to skip on int 3 when ida debug?

I tried to debug a windows application, but when I debug it with Ida, it stopped on int 3 instruction. I read that int 3 catch debugger so I cant debug. How can I cancel this int 3? How call to int ...
user avatar
  • 503