All Questions
Tagged with anti-debugging debugging
23 questions
1
vote
0
answers
86
views
How to develop an anti-debug library which allow users to debug their own programs but not the library?
I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows).
The down side of this library is: users would be abled to debug their own ...
- 81
-1
votes
1
answer
179
views
Anti-patching checksum [closed]
I'm busy with debugging a program in x64dbg and it has some kind of anti-patching mechanism so can someone please advise me on how I would go about finding the functions which are calculating the ...
- 49
2
votes
2
answers
4k
views
How to debug / analyze a Themida protected binary
Background: I have an application that has worked fine up until Windows 10 build 1511 but broke as of build 1607. It produces an access violation:
STACK_TEXT:
03799f54 00f91cfa 24d1ae78 0000000f ...
- 3,283
1
vote
1
answer
466
views
IDA Pro Debbuger is debugging the original code and not the patched code
Using IDA Pro, I tried to patch int 2Dh to nop.
However, with the debugger, it seems that the original code is being loaded.
What may be the reason for that? This might be related for some protections?...
- 113
0
votes
0
answers
773
views
Bypass Javascript Debug Prevention in Firefox
I've looked around, and can't find an answer for my specific question. The closest I could find was this.
I'm trying to reverse engineer some suspicious Javascript, but it repeatedly calls a debugger ...
- 1
2
votes
1
answer
3k
views
Program prevents x64dbg from starting or kills it if it's already running. What to do?
I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows.
It looks like the program has some sort of anti-debug protection. I have the following behavior:
...
- 21
2
votes
1
answer
278
views
Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff
I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it.
Pretext:
...
- 21
0
votes
0
answers
178
views
Anti-re tactics or radare problem while debugging
Here's the target application: https://www.sa-mp.com/download.php
While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
- 101
3
votes
3
answers
2k
views
Debug program using peculiar anti-debugging technique
In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques.
One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
- 3,419
-1
votes
1
answer
1k
views
Program closing even with IsDebuggerPresent Patched!
i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways.
Steps i Followed ...
- 1
3
votes
2
answers
2k
views
Jump in the middle trick
I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
-1
votes
1
answer
2k
views
VMProtect keygen, turn off the anti-debugging
who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
- 141
3
votes
0
answers
179
views
Anti-debug that can broke programm links (branches)?
I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image:
...
- 31
8
votes
1
answer
5k
views
How to investigate Windows 32/64bit (WOW64) transition
There is surprisingly little information about Windows WOW64 mechanism.
I'm trying to investigate it.
So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
- 273
0
votes
2
answers
185
views
Antidebug/reverse engineering targeted for libraries [closed]
So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables.
Are there any resources that target specifically shared and ...
- 103
1
vote
1
answer
2k
views
how to bypass exception to debug EXE
i am trying to debug and find the encryption password algorithm in a Windows Application.
Whenever i try to debug, setting a breakpoint or not, the application gives a exception:
is it some kind of ...
- 113
1
vote
0
answers
993
views
Immunity Debugger Unable to set Breakpoint
I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try.
The first error is that Immunity is 'Unable ...
- 11
2
votes
0
answers
5k
views
A debugger has been found running in your system
For education reasons I just came into reverse engineering, so I found an app that I want to reverse. Basically it has a basic auth system (login and pass). I sniffed traffic with Wireshark and found ...
7
votes
2
answers
2k
views
"Debugged application has modified the debugging registers" with ollydbg 2.01
I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here:
Debugged application has modified the debugging registers.
Maybe it called ZwContinue() or ...
- 1,541
2
votes
0
answers
190
views
How can one debug a program that can only be started by other processes?
I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger.
The program starts by using a bash script wrapper to process input parameters, ...
6
votes
1
answer
2k
views
Handling INT 2D anti-debugger technique in IDA Pro
I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging:
CODE:00455050 push ebp
CODE:00455051 mov ebp, esp
CODE:00455053 push ecx
CODE:00455054 push ebx
...
- 235
0
votes
1
answer
2k
views
How do memory integrity checks work?
How does a memory integrity check work? For example, the .code memory region is scanned by this check and then changes can be detected and the program will return with an event that will exit the ...
- 39
4
votes
1
answer
99
views
registers set by function
How can I figure out which general-purpose registers are modified by a function call. I am programming a Win32 Assembly program that calls IsDebuggerPresent(). According to MSDN, it will return a ...
- 113