Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [anti-debugging]

Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.

0
votes
0answers
34 views

IDA Pro debugging on OS X

Is there some trick to getting debugging working on OS X with IDA? I've tried a number of different approaches, and a number of different apps, but no matter what I do, either I get SIGNINTs or ...
0
votes
1answer
74 views

Searching for a sequence of bytes in IDA

Using an hardware breakpoint, I found with Ollydbg that a crackme was checking for the isDebuggerPresent flag. I'd like to find this part of the code using IDA now. I first looked in the import table,...
0
votes
0answers
49 views

Radare2 Debugger Crashes — SIGNAL 17, anti-debugger?

I am having a hard time debugging a piece of software. It appears that the creator of this "crackme" challenge has installed an anti-debugger to kill the process whenever I try to debug. I need to ...
3
votes
0answers
96 views

Instruction counting anti-debug

I recently came across this anti-debug technique being used in the wild. In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section A debugger will interfere ...
0
votes
0answers
48 views

debugger trap with angr

Let's suppose this (very ugly) c code: #include <stdio.h> #include <string.h> #include <signal.h> char sav_argv[100]; void on_sigtrap(int signo) { if (strcmp(sav_argv, "hello")...
2
votes
1answer
155 views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...
3
votes
1answer
170 views

Thread EntryPoint in TLS callback as AntiDebug technique

I came across a document called The Ultimate Anti-Reversing Reference, which describes various Anti-Debugging techniques. in point 4.Thread Local Storage There is a mention Thread Local Storage ...
1
vote
0answers
89 views

Failed to set breakpoint (Anti-debug protection)

Sorry for my bad English in advance. There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
2answers
361 views

How to skip on int 3 when ida debug?

I tried to debug a windows application, but when I debug it with Ida, it stopped on int 3 instruction. I read that int 3 catch debugger so I cant debug. How can I cancel this int 3? How call to int ...
3
votes
1answer
466 views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
0
votes
1answer
68 views

Cant debug software with ida [closed]

I have software that run on windows well. I tried to debug it with IDA (local win32 debug) but when I start it I see that exeption throw and I cant debug it. I dont use breakpoints Is that anti ...
-1
votes
1answer
474 views

VMProtect keygen, turn off the anti-debugging

who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
4
votes
4answers
5k views

Finding OEP in a VMProtect v3.0 protected malware

I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...
0
votes
1answer
172 views

How can I circumvent rdtsc when used as an anti-debugger technique?

I using x86dbg and am working on unpacking a target. The unpacking stub appears to be using some anti-debugging techniques - most of which I can detour with a plugin. However, there are a lot of ...
0
votes
0answers
25 views

Is it possible from usermode to see if a process has opened /proc/$currentprocpid/mem?

Im looking into Linux anti debugging techniques and I know some of the more common tricks like ptraceing yourself, but is it possible to see if a program has opened the current process virtual ...
0
votes
0answers
91 views

Set a Breakpoint in an executable type dynamic (ET_DYN)

I am trying to debug an executable marked as a shared object. I know the trick of run it in GDB and stop with CTRL+C, and other tricks from the question How to handle stripped binaries with GDB? No ...
0
votes
1answer
187 views

Working backwards from a popup

I'm currently trying to reverse engineer a game,but there's and anti-debug, so far the only leads I've tried to follow are: I found an IsDebuggerPresent API, I tried to change the value of EAX by ...
2
votes
1answer
1k views

Bypass IsDebuggerPresent

I have an address, that I think is not allowing me to run the debugger in IDA, I need help trying to stop it. Also , what does kernel32_IsDebuggerPresent mean?
0
votes
1answer
101 views

Help with anti-disassembly trick inside a hooked function

I am trying to understand a hook installed by a program within the Win32 API function ZwWriteVirtualMemory. It seems that a jmp inside an instruction is used and I couldn't fix it to be able to ...
4
votes
1answer
1k views

Detecting hardware breakpoints

Since software breakpoints, unlike hardware breakpoints , do change the code, it's relatively easy to write a program that performs a checksum on itself as an anti-debugger technique. Is it possible ...
2
votes
0answers
106 views

Anti-debug that can broke programm links (branches)?

I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image: ...
8
votes
1answer
1k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
0
votes
1answer
521 views

C++ Anti Kernel Debugger?

What are some things I can do to do anti kernel debugging from user-mode C++? I already use ZwQuerySystemInformation to query for SystemKernelDebuggerInformation.
0
votes
0answers
90 views

Integrity Check signature is different on every run

I am attempting to implement an application-source integrity check in an iOS application to prevent anyone from modifying and re-installing the binary. I am currently using this tutorial (scroll down ...
0
votes
0answers
72 views

help understanding the output of stace for application that use anti-debugging technique

I was trying to debug an android app that implement anti-debugging technique. The app encrypts the .so library so I cannot figure much from it . when I attach stace to the app the app crash ...
0
votes
0answers
1k views

Anti-anti-debug

I'm using: TitanHide + ScyllaHide on x64dbg. I have an application that attempts to prevent the debugger from attaching. One of the ways it succeeds in doing this is by hooking two functions in ...
-2
votes
1answer
173 views

Anti-Reverse Question on implementing a Shellcode

I am trying to make things harder for someone to reverse my code. I think that implementing a shellcode following this article could work for my case. How can I access (or share) global variables in ...
2
votes
2answers
1k views

Immunity debugger anti anti debug

I using Windows, and I was wondering what is the best anti anti debug plugin that exist, I tried to use hidedebug by Bob -> Team PEiD, but unfortunately it catch only the regular ways, I know that ...
2
votes
1answer
585 views

how to overcome setunhandledexceptionfilter in ollyDebugger?

I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this. Can you guys please explain the setunhandledexceptionfilter() anti-...
0
votes
2answers
124 views

Antidebug/reverse engineering targeted for libraries [closed]

So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables. Are there any resources that target specifically shared and ...
1
vote
1answer
696 views

how to bypass exception to debug EXE

i am trying to debug and find the encryption password algorithm in a Windows Application. Whenever i try to debug, setting a breakpoint or not, the application gives a exception: is it some kind of ...
0
votes
1answer
205 views

Is this anti-tamper solution fool-proof?

https://libreboot.org/faq/#intelme Introduced in June 2006 in Intel's 965 Express Chipset Family of (Graphics and) Memory Controller Hubs, or (G)MCHs, and the ICH8 I/O Controller Family, the Intel ...
1
vote
2answers
3k views

Getting past a whole lot of anti-debug measures for a windows exe

I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the ...
1
vote
1answer
823 views

how do I bypass ZwQueryInformationProcess as anti-debugging protection

How do I defeat the ZwQueryInformationProcess() anti-debugging protection for the ProcessDebugPort class? Unlike isDebuggerPresent() I found this really hard to bypass in my skill... Does anyone ...
1
vote
0answers
598 views

Immunity Debugger Unable to set Breakpoint

I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try. The first error is that Immunity is 'Unable ...
5
votes
1answer
442 views

Modifying PPID to avoid anti-debugging measure

I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits. To ...
2
votes
1answer
683 views

Has anyone tried ptrace_attaching android unity apps for anti debugging?

I am trying to ptrace_attach the main process and its threads (/proc/<pid>/task) of an android unity app to avoid malicious users debugging the app(which is a game). I developed a ndk library ...
1
vote
1answer
250 views

What is the reason for INT 0x2D byte scission?

What is the reason behind the byte scission (the next immediate byte following "int 2d" is skipped) behaviour when executing INT 0x2D? I came across this article http://www.drdobbs.com/monitoring-nt-...
1
vote
3answers
253 views

What is the average time for “defusing” malware self-protection mechanisms?

I always wondered how much time is needed to get rid of all that anti-VM/crypto/protector/anti-debug stuff (without analyzing actual payload and purpose), especially if you're dealing with malware on ...
1
vote
1answer
142 views

Detect Debugger exploring Stack

I am interested in the following technique to detect if a debugger is attached or not. http://spareclockcycles.org/2012/02/14/stack-necromancy-defeating-debuggers-by-raising-the-dead/ However I ...
4
votes
2answers
1k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
3
votes
1answer
218 views

Self modifying codes

Recently I have found the article Using UPX as a Security Packer. Here, UPX is patched, after decompressing, also restores some overwritten bytes. This way, if somebody decompresses the binary with ...
0
votes
2answers
722 views

Detecting debugger with `rdtsc`

I am reading Eldad Eilam's book titled Reversing. In Chapter 11: Breaking Protections, there is a crackme called Defender, which creates a dedicated thread, which repeats the following steps: 1. ...
1
vote
0answers
76 views

An anti debug method on Linux [duplicate]

I have found this question (linux) How to debug a "debugger"? It is an anti debug technique, the parent creates a forked process and ptrace it. Now gdb can not attach top the child process. ...
0
votes
1answer
486 views

Hiding call to ptrace [duplicate]

I am trying to detect whether my executable is running in a debugger. Here is a solution using ptrace. My problem is that even if my executable is stripped (strip a.out) I am able to find with gdb the ...
3
votes
1answer
572 views

using GDB and dealing with breakpoint detection

I am trying to solve a reverse engineering challenge using using gdb. I can run the program inside it but when I set a breakpoint at main then I get Program received signal SIGSEGV, Segmentation ...
3
votes
1answer
2k views

Main Thread causes an exception - how to bypass that?

I analyze a piece of malware and I am faced with the following problem: The main thread of the malware spawns some threads. After the first thread is generated, the main thread jumps to a non-existent ...
2
votes
0answers
184 views

Malware analysis - AntiDebugging - Malware slows down the PC while being debugged

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution: Being executed Decrypt a lot of data from memory and obtain a new PE (from memory) Create a child ...
2
votes
0answers
263 views

Anti-dumping techniques [duplicate]

After handing on some crackmes using packed codes, I am now curious about anti-dumping techniques. For the crackmes I have encoutered, my method is as follows: after the program unpacks itself, I take ...
1
vote
0answers
2k views

A debugger has been found running in your system

For education reasons I just came into reverse engineering, so I found an app that I want to reverse. Basically it has a basic auth system (login and pass). I sniffed traffic with Wireshark and found ...