Questions tagged [anti-debugging]
Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.
140 questions
1
vote
0
answers
76
views
How to bypass anti-debugging protection with Segmentation falt?
I am trying to solve crackme. But I have no experience with obfuscation and anti-debugging protection. Crackme just asks for flag and prompts it is incorrect. In debbuger it always crashes with ...
- 131
1
vote
0
answers
151
views
Why some anti-debugging/malware does `wmiadap.exe /f /t /r`?
It seems some possibly legit software, but also malware does wmiadap.exe /f /t /r. Apparently it's part of their anti-debugging attempts. (On Linux some such software I've seen drops a coredump_filter ...
1
vote
0
answers
65
views
UPX anti unpacking (upx -d)
To start, I know that there is a post on this platform from 2013 that asked the same question but since it's been a while, I will ask it again.
A few months back I recall to find a github repo / ...
0
votes
0
answers
105
views
Question about anti-debug methods and anti-anti-debug methods
I've come across several binaries that have simple anti-debug methods in place, like checking IsDebuggerPresent(), NtQueryInformationProcess(), etc. But I recently came across a binary that looked ...
- 133
1
vote
0
answers
86
views
How to develop an anti-debug library which allow users to debug their own programs but not the library?
I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows).
The down side of this library is: users would be abled to debug their own ...
- 81
2
votes
0
answers
75
views
Javascript: Compare Control Flow (to evade anti-debug and anti-tamper traps)
When reverse engineering obfuscated javascript, it may be protected by anti-tamper mechanisms.
I have a script which will work when run untouched, but cause a fatal javascript error when run in node ...
- 143
3
votes
0
answers
365
views
Weird anti-debugging mechanism
I am trying to grasp an anti-debugging trick used in this program. Upon attaching any debugger (x64dbg, VEH debugger) the software crashes after about 2 seconds.
x64dbg shows me that the following ...
- 151
-1
votes
1
answer
179
views
Anti-patching checksum [closed]
I'm busy with debugging a program in x64dbg and it has some kind of anti-patching mechanism so can someone please advise me on how I would go about finding the functions which are calculating the ...
- 49
3
votes
1
answer
1k
views
VMProtect Anti-debugging method (without WiNAPI)
First, sorry for my bad english.
I'm trying to make VMProtect unpacker with unicorn emulator, but one of my sample shows me like this anti-debugging message:
WTSSendMessageW: "A debugger has been ...
- 63
2
votes
1
answer
436
views
Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application
I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
0
votes
1
answer
269
views
Is that message mean the program has an anti-debugger?
When trying to debug a program using the x64dbg and in a specific step, the following problem happens:
Is that mean that the program has an anti-debugger?
if not, why when debugging the program and ...
- 269
0
votes
1
answer
708
views
How can I detect if my application is running in x64debug?
I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response.
When building the application, I am easily able to detect it is ...
- 3
2
votes
2
answers
4k
views
How to debug / analyze a Themida protected binary
Background: I have an application that has worked fine up until Windows 10 build 1511 but broke as of build 1607. It produces an access violation:
STACK_TEXT:
03799f54 00f91cfa 24d1ae78 0000000f ...
- 3,283
0
votes
1
answer
2k
views
How to bypass anti-debugging C++
So I have a crackme my friend sent to try and crack it but the problem that I cannot bypass the anti-debugging or even patching it.
I even tried using ScyllaHide at max settings but still it detects ...
1
vote
1
answer
466
views
IDA Pro Debbuger is debugging the original code and not the patched code
Using IDA Pro, I tried to patch int 2Dh to nop.
However, with the debugger, it seems that the original code is being loaded.
What may be the reason for that? This might be related for some protections?...
- 113
0
votes
0
answers
773
views
Bypass Javascript Debug Prevention in Firefox
I've looked around, and can't find an answer for my specific question. The closest I could find was this.
I'm trying to reverse engineer some suspicious Javascript, but it repeatedly calls a debugger ...
- 1
2
votes
0
answers
281
views
Anti-Reversing: Unable to patch memory/set breakpoints of process with x64, unusual memory segment
I'm working on a sample that contains packing and anti-analysis measures.
Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried ...
- 203
2
votes
1
answer
3k
views
Program prevents x64dbg from starting or kills it if it's already running. What to do?
I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows.
It looks like the program has some sort of anti-debug protection. I have the following behavior:
...
- 21
6
votes
1
answer
2k
views
Why does PE ImageBase address change in memory?
I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
- 61
1
vote
0
answers
122
views
Debugged process not break on breakpoint
I launch a game process then I suspend the process and restore the hooks in ntdll.dll then I attach debugger to the process and resume the process. Next I see debugger catch the 0xC0000005(access ...
- 11
-1
votes
1
answer
150
views
How can I analyze this code? [closed]
I wanted to analyse the code for some functionality.
in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
- 309
-1
votes
1
answer
139
views
Force debug Administrator Malware
I want to analyse a malware that do not run without administrative previliges.
I know it is risky but still.
How can I debug it with debugger as from entry point?
Because debugger could not start ...
- 101
3
votes
2
answers
1k
views
Guidelines for dealing with obfuscated code
I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
- 145
2
votes
1
answer
278
views
Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff
I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it.
Pretext:
...
- 21
2
votes
1
answer
591
views
Invalid file path error while trying to rebuild with apktool and aapt2
I am facing an error while try to repack an apk with apkool. below is the error trace.
W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'.
W: error: invalid file ...
- 309
0
votes
0
answers
178
views
Anti-re tactics or radare problem while debugging
Here's the target application: https://www.sa-mp.com/download.php
While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
- 101
0
votes
1
answer
2k
views
Android app crashes even while not edited, how can I solve it?
Installed an application from google playstore and then transferred to it my computer to apparently edit it and without any changes I made to it then I tried to install it through ADB, well the ...
- 309
1
vote
2
answers
909
views
Finding call trace of a crashing executable with anti-debugging techniques
The application I target has terribly annoying anti-debugging techniques. With x32dbg and ScyllaHide with the following configuration, the application exits immediately as soon as a breakpoint is hit, ...
- 111
2
votes
1
answer
788
views
Anti-debug clearing hardware breakpoints
An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg.
I am observing the following behaviour:
When placing the first hw breakpoint, it is ...
- 157
1
vote
1
answer
1k
views
Getting NTSTATUS 0xC0000022 when attempting to debug a process
I am attempting to debug a process with windbg (with admin privileges) and I am getting the following error:
Could not attach to process XXXX =, NTSTATUS 0xC0000022
{Access Denied} A process has ...
- 255
1
vote
0
answers
2k
views
Pe file Vmp0 vmp1 section,
I have a PE file with section vmp0 vmp1, possible protected with VMProtect. I am using local debugger in IDA pro, the program will detect the debugger and pop-up an message box and quit , I used the ...
1
vote
2
answers
280
views
How to solve this anti-disassembler trick?
I have this __asm instruction in C code:
int func_0x8b4c55a0()
{
__asm
{
call $ +5
add[esp],5
ret
}
}
int main()
{
char cVar1;
if ((cVar1 = ...
- 111
0
votes
1
answer
531
views
What is the usual way to determine if a Game uses KernelMode or UserMode Anti cheat?
How does one find out if a game uses KernelMode anti cheat or UserMode?
For example the Game Black Desert Online uses Xigncode.
If i google a bit about Xigncode i immediately find out that:
"...
- 113
1
vote
0
answers
56
views
Is it possible to define the adress of a function in assembly?
I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc.
Here is the PoC program :
BITS 32
EXTERN ...
- 283
0
votes
1
answer
526
views
Advanced Anti-Debugging Techniques
I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like IsDebuggerPresent and CheckRemoteDebuggerPresent?
- 103
2
votes
0
answers
836
views
How to virtualize part of a code like VMProtect does?
I am a new student in the field of cybersecurity.
I would like to learn more about how virtualization used by software such as CodeVirtualizer and VMProtect works, and ideally to be able to ...
- 21
1
vote
1
answer
1k
views
anti-debugger techniques for shared library
I'm adding copyright protection to a demo version of a shared library. I've seem some recommendations to add timing around license violation detection codes -- which would be debugger + patch targets ...
- 13
1
vote
0
answers
554
views
Process terminating when breakpoint reached
I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
- 11
3
votes
3
answers
2k
views
Debug program using peculiar anti-debugging technique
In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques.
One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
- 3,419
-1
votes
1
answer
1k
views
Program closing even with IsDebuggerPresent Patched!
i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways.
Steps i Followed ...
- 1
0
votes
1
answer
8k
views
Bypassing anti-debugging
I'm trying to RE Stardew Valley to write cheats for it. The problem is that when I trace the pointers for my health/energy/etc... back more than one level the game crashes. It probably has some kind ...
- 111
-2
votes
1
answer
113
views
Can any one de-obfuscator this php code [closed]
my developer has changed all his contact info and i am unable to contact him
and i want to move my site to another server but because of this obfuscator code in my php script i am unable to move my ...
- 1
3
votes
1
answer
2k
views
Anti-disassembler techniques and IDA Pro
I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having ...
- 161
1
vote
1
answer
812
views
Fork and Waitpid calls in a CTF linux binary
I'm doing one of my first linux crackmes.
In the first blocks of code, it goes inside some anti-debug routine and inside one of those it forks and after it calls a waitpid routine. I can verify it ...
- 439
3
votes
2
answers
2k
views
Jump in the middle trick
I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
2
votes
1
answer
809
views
Radare2 does not display the entire assembler code
I am trying to solve this ELF - Ptrace crack me. Here are the commands I use :
I start radare2 with the crack me as argument.
radare2 ch3.bin
I decide to go to the main and print the assembly code ...
- 221
1
vote
1
answer
2k
views
How int3 looks like in C
This is assembly code that can catch debugger with int 3 :
MOV ECX, ExceptionHandler
MOV DWORD PTR FS:[0], ExceptionHandler
INT3
///there is debugger!!!
ExceptionHandler:
////no ...
2
votes
1
answer
2k
views
What is __sighandler_t struct and purpose of SIGTRAP signal handler
I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value :
.text:08048063 ...
- 283
2
votes
1
answer
461
views
dongle check happen before a debugger start debugging
i'm trying to fake the test ( dongle exist )
but one problem that i encounter is that the application detect it before i start debugging it .
this is what happen with more details : open( not ...
- 21
3
votes
1
answer
5k
views
VMProtect anti-debug method
I recently found a nice crackme which uses VMProtect 3.x as defense.
After doing a little research online I found couple of API's VMProtect uses as an anti debug method.
I set software breakpoint on ...
- 31