Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [anti-debugging]

Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.

0
votes
1answer
107 views

How int3 looks like in C

This is assembly code that can catch debugger with int 3 : MOV ECX, ExceptionHandler MOV DWORD PTR FS:[0], ExceptionHandler INT3 ///there is debugger!!! ExceptionHandler: ////no ...
2
votes
1answer
39 views

What is __sighandler_t struct and purpose of SIGTRAP signal handler

I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value : .text:08048063 ...
2
votes
1answer
43 views

dongle check happen before a debugger start debugging

i'm trying to fake the test ( dongle exist ) but one problem that i encounter is that the application detect it before i start debugging it . this is what happen with more details : open( not ...
2
votes
1answer
113 views

VMProtect anti-debug method

I recently found a nice crackme which uses VMProtect 3.x as defense. After doing a little research online I found couple of API's VMProtect uses as an anti debug method. I set software breakpoint on ...
1
vote
1answer
37 views

What is happening with these exceptions in OllyDbg?

I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
0
votes
0answers
46 views

IDA Pro debugging on OS X

Is there some trick to getting debugging working on OS X with IDA? I've tried a number of different approaches, and a number of different apps, but no matter what I do, either I get SIGNINTs or ...
0
votes
1answer
91 views

Searching for a sequence of bytes in IDA

Using an hardware breakpoint, I found with Ollydbg that a crackme was checking for the isDebuggerPresent flag. I'd like to find this part of the code using IDA now. I first looked in the import table,...
0
votes
0answers
71 views

Radare2 Debugger Crashes — SIGNAL 17, anti-debugger?

I am having a hard time debugging a piece of software. It appears that the creator of this "crackme" challenge has installed an anti-debugger to kill the process whenever I try to debug. I need to ...
3
votes
0answers
106 views

Instruction counting anti-debug

I recently came across this anti-debug technique being used in the wild. In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section A debugger will interfere ...
0
votes
0answers
73 views

debugger trap with angr

Let's suppose this (very ugly) c code: #include <stdio.h> #include <string.h> #include <signal.h> char sav_argv[100]; void on_sigtrap(int signo) { if (strcmp(sav_argv, "hello")...
2
votes
1answer
215 views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...
3
votes
1answer
270 views

Thread EntryPoint in TLS callback as AntiDebug technique

I came across a document called The Ultimate Anti-Reversing Reference, which describes various Anti-Debugging techniques. in point 4.Thread Local Storage There is a mention Thread Local Storage ...
1
vote
0answers
104 views

Failed to set breakpoint (Anti-debug protection)

Sorry for my bad English in advance. There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
2answers
556 views

How to skip on int 3 when ida debug?

I tried to debug a windows application, but when I debug it with Ida, it stopped on int 3 instruction. I read that int 3 catch debugger so I cant debug. How can I cancel this int 3? How call to int ...
3
votes
1answer
646 views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
0
votes
1answer
70 views

Cant debug software with ida [closed]

I have software that run on windows well. I tried to debug it with IDA (local win32 debug) but when I start it I see that exeption throw and I cant debug it. I dont use breakpoints Is that anti ...
-1
votes
1answer
592 views

VMProtect keygen, turn off the anti-debugging

who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
4
votes
4answers
6k views

Finding OEP in a VMProtect v3.0 protected malware

I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...
0
votes
1answer
194 views

How can I circumvent rdtsc when used as an anti-debugger technique?

I using x86dbg and am working on unpacking a target. The unpacking stub appears to be using some anti-debugging techniques - most of which I can detour with a plugin. However, there are a lot of ...
0
votes
0answers
25 views

Is it possible from usermode to see if a process has opened /proc/$currentprocpid/mem?

Im looking into Linux anti debugging techniques and I know some of the more common tricks like ptraceing yourself, but is it possible to see if a program has opened the current process virtual ...
0
votes
0answers
100 views

Set a Breakpoint in an executable type dynamic (ET_DYN)

I am trying to debug an executable marked as a shared object. I know the trick of run it in GDB and stop with CTRL+C, and other tricks from the question How to handle stripped binaries with GDB? No ...
0
votes
1answer
245 views

Working backwards from a popup

I'm currently trying to reverse engineer a game,but there's and anti-debug, so far the only leads I've tried to follow are: I found an IsDebuggerPresent API, I tried to change the value of EAX by ...
2
votes
1answer
2k views

Bypass IsDebuggerPresent

I have an address, that I think is not allowing me to run the debugger in IDA, I need help trying to stop it. Also , what does kernel32_IsDebuggerPresent mean?
0
votes
1answer
107 views

Help with anti-disassembly trick inside a hooked function

I am trying to understand a hook installed by a program within the Win32 API function ZwWriteVirtualMemory. It seems that a jmp inside an instruction is used and I couldn't fix it to be able to ...
4
votes
1answer
2k views

Detecting hardware breakpoints

Since software breakpoints, unlike hardware breakpoints , do change the code, it's relatively easy to write a program that performs a checksum on itself as an anti-debugger technique. Is it possible ...
2
votes
0answers
117 views

Anti-debug that can broke programm links (branches)?

I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image: ...
8
votes
1answer
2k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
0
votes
1answer
573 views

C++ Anti Kernel Debugger?

What are some things I can do to do anti kernel debugging from user-mode C++? I already use ZwQuerySystemInformation to query for SystemKernelDebuggerInformation.
0
votes
0answers
100 views

Integrity Check signature is different on every run

I am attempting to implement an application-source integrity check in an iOS application to prevent anyone from modifying and re-installing the binary. I am currently using this tutorial (scroll down ...
0
votes
0answers
74 views

help understanding the output of stace for application that use anti-debugging technique

I was trying to debug an android app that implement anti-debugging technique. The app encrypts the .so library so I cannot figure much from it . when I attach stace to the app the app crash ...
0
votes
0answers
1k views

Anti-anti-debug

I'm using: TitanHide + ScyllaHide on x64dbg. I have an application that attempts to prevent the debugger from attaching. One of the ways it succeeds in doing this is by hooking two functions in ...
-2
votes
1answer
184 views

Anti-Reverse Question on implementing a Shellcode

I am trying to make things harder for someone to reverse my code. I think that implementing a shellcode following this article could work for my case. How can I access (or share) global variables in ...
2
votes
2answers
1k views

Immunity debugger anti anti debug

I using Windows, and I was wondering what is the best anti anti debug plugin that exist, I tried to use hidedebug by Bob -> Team PEiD, but unfortunately it catch only the regular ways, I know that ...
2
votes
1answer
656 views

how to overcome setunhandledexceptionfilter in ollyDebugger?

I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this. Can you guys please explain the setunhandledexceptionfilter() anti-...
0
votes
2answers
130 views

Antidebug/reverse engineering targeted for libraries [closed]

So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables. Are there any resources that target specifically shared and ...
1
vote
1answer
767 views

how to bypass exception to debug EXE

i am trying to debug and find the encryption password algorithm in a Windows Application. Whenever i try to debug, setting a breakpoint or not, the application gives a exception: is it some kind of ...
0
votes
1answer
214 views

Is this anti-tamper solution fool-proof?

https://libreboot.org/faq/#intelme Introduced in June 2006 in Intel's 965 Express Chipset Family of (Graphics and) Memory Controller Hubs, or (G)MCHs, and the ICH8 I/O Controller Family, the Intel ...
1
vote
2answers
3k views

Getting past a whole lot of anti-debug measures for a windows exe

I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the ...
1
vote
1answer
885 views

how do I bypass ZwQueryInformationProcess as anti-debugging protection

How do I defeat the ZwQueryInformationProcess() anti-debugging protection for the ProcessDebugPort class? Unlike isDebuggerPresent() I found this really hard to bypass in my skill... Does anyone ...
1
vote
0answers
620 views

Immunity Debugger Unable to set Breakpoint

I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try. The first error is that Immunity is 'Unable ...
4
votes
1answer
450 views

Modifying PPID to avoid anti-debugging measure

I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits. To ...
1
vote
1answer
715 views

Has anyone tried ptrace_attaching android unity apps for anti debugging?

I am trying to ptrace_attach the main process and its threads (/proc/<pid>/task) of an android unity app to avoid malicious users debugging the app(which is a game). I developed a ndk library ...
1
vote
1answer
259 views

What is the reason for INT 0x2D byte scission?

What is the reason behind the byte scission (the next immediate byte following "int 2d" is skipped) behaviour when executing INT 0x2D? I came across this article http://www.drdobbs.com/monitoring-nt-...
1
vote
3answers
260 views

What is the average time for “defusing” malware self-protection mechanisms?

I always wondered how much time is needed to get rid of all that anti-VM/crypto/protector/anti-debug stuff (without analyzing actual payload and purpose), especially if you're dealing with malware on ...
1
vote
1answer
149 views

Detect Debugger exploring Stack

I am interested in the following technique to detect if a debugger is attached or not. http://spareclockcycles.org/2012/02/14/stack-necromancy-defeating-debuggers-by-raising-the-dead/ However I ...
4
votes
2answers
2k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
3
votes
1answer
226 views

Self modifying codes

Recently I have found the article Using UPX as a Security Packer. Here, UPX is patched, after decompressing, also restores some overwritten bytes. This way, if somebody decompresses the binary with ...
0
votes
2answers
775 views

Detecting debugger with `rdtsc`

I am reading Eldad Eilam's book titled Reversing. In Chapter 11: Breaking Protections, there is a crackme called Defender, which creates a dedicated thread, which repeats the following steps: 1. ...
1
vote
0answers
93 views

An anti debug method on Linux [duplicate]

I have found this question (linux) How to debug a "debugger"? It is an anti debug technique, the parent creates a forked process and ptrace it. Now gdb can not attach top the child process. ...
0
votes
1answer
530 views

Hiding call to ptrace [duplicate]

I am trying to detect whether my executable is running in a debugger. Here is a solution using ptrace. My problem is that even if my executable is stripped (strip a.out) I am able to find with gdb the ...