Questions tagged [anti-debugging]

Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

How to solve this anti-disassembler trick?

I have this __asm instruction in C code: int func_0x8b4c55a0() { __asm { call $ +5 add[esp],5 ret } } int main() { char cVar1; if ((cVar1 = ...
0
votes
2answers
122 views

What is the usual way to determine if a Game uses KernelMode or UserMode Anti cheat?

How does one find out if a game uses KernelMode anti cheat or UserMode? For example the Game Black Desert Online uses Xigncode. If i google a bit about Xigncode i immediately find out that: "...
1
vote
0answers
34 views

Is it possible to define the adress of a function in assembly?

I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc. Here is the PoC program : BITS 32 EXTERN ...
0
votes
0answers
76 views

How to defeat fake rdtsc driver?

This RSE thread and this one discuss effectiveness of RDTSC-based anti-debug methods, and also a way to possibly work-around (albeit using a fake driver method, which is complex). What is a counter-...
0
votes
0answers
115 views

Advanced Anti-Debugging Techniques

I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like IsDebuggerPresent and CheckRemoteDebuggerPresent?
1
vote
0answers
79 views

How to virtualize part of a code like VMProtect does?

I am a new student in the field of cybersecurity. I would like to learn more about how virtualization used by software such as CodeVirtualizer and VMProtect works, and ideally to be able to ...
0
votes
1answer
208 views

anti-debugger techniques for shared library

I'm adding copyright protection to a demo version of a shared library. I've seem some recommendations to add timing around license violation detection codes -- which would be debugger + patch targets ...
1
vote
0answers
70 views

Process terminating when breakpoint reached

I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
2
votes
2answers
174 views

Debug program using peculiar anti-debugging technique

In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques. One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
-1
votes
1answer
126 views

Program closing even with IsDebuggerPresent Patched!

i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways. Steps i Followed ...
0
votes
1answer
436 views

Bypassing anti-debugging

I'm trying to RE Stardew Valley to write cheats for it. The problem is that when I trace the pointers for my health/energy/etc... back more than one level the game crashes. It probably has some kind ...
-2
votes
1answer
64 views

Can any one de-obfuscator this php code [closed]

my developer has changed all his contact info and i am unable to contact him and i want to move my site to another server but because of this obfuscator code in my php script i am unable to move my ...
1
vote
1answer
339 views

Anti-disassembler techniques and IDA Pro

I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having ...
1
vote
1answer
178 views

Fork and Waitpid calls in a CTF linux binary

I'm doing one of my first linux crackmes. In the first blocks of code, it goes inside some anti-debug routine and inside one of those it forks and after it calls a waitpid routine. I can verify it ...
2
votes
2answers
221 views

Jump in the middle trick

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
2
votes
1answer
128 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
1
vote
1answer
237 views

How int3 looks like in C

This is assembly code that can catch debugger with int 3 : MOV ECX, ExceptionHandler MOV DWORD PTR FS:[0], ExceptionHandler INT3 ///there is debugger!!! ExceptionHandler: ////no ...
2
votes
1answer
173 views

What is __sighandler_t struct and purpose of SIGTRAP signal handler

I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value : .text:08048063 ...
2
votes
1answer
98 views

dongle check happen before a debugger start debugging

i'm trying to fake the test ( dongle exist ) but one problem that i encounter is that the application detect it before i start debugging it . this is what happen with more details : open( not ...
2
votes
1answer
741 views

VMProtect anti-debug method

I recently found a nice crackme which uses VMProtect 3.x as defense. After doing a little research online I found couple of API's VMProtect uses as an anti debug method. I set software breakpoint on ...
1
vote
1answer
201 views

What is happening with these exceptions in OllyDbg?

I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 ...
0
votes
1answer
186 views

Searching for a sequence of bytes in IDA

Using an hardware breakpoint, I found with Ollydbg that a crackme was checking for the isDebuggerPresent flag. I'd like to find this part of the code using IDA now. I first looked in the import table,...
3
votes
0answers
175 views

Instruction counting anti-debug

I recently came across this anti-debug technique being used in the wild. In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section A debugger will interfere ...
0
votes
0answers
199 views

debugger trap with angr

Let's suppose this (very ugly) c code: #include <stdio.h> #include <string.h> #include <signal.h> char sav_argv[100]; void on_sigtrap(int signo) { if (strcmp(sav_argv, "hello")...
2
votes
1answer
557 views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...
3
votes
1answer
630 views

Thread EntryPoint in TLS callback as AntiDebug technique

I came across a document called The Ultimate Anti-Reversing Reference, which describes various Anti-Debugging techniques. in point 4.Thread Local Storage There is a mention Thread Local Storage ...
1
vote
0answers
175 views

Failed to set breakpoint (Anti-debug protection)

Sorry for my bad English in advance. There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
2answers
2k views

How to skip on int 3 when ida debug?

I tried to debug a windows application, but when I debug it with Ida, it stopped on int 3 instruction. I read that int 3 catch debugger so I cant debug. How can I cancel this int 3? How call to int ...
3
votes
1answer
2k views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
0
votes
1answer
90 views

Cant debug software with ida [closed]

I have software that run on windows well. I tried to debug it with IDA (local win32 debug) but when I start it I see that exeption throw and I cant debug it. I dont use breakpoints Is that anti ...
-1
votes
1answer
962 views

VMProtect keygen, turn off the anti-debugging

who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
4
votes
4answers
12k views

Finding OEP in a VMProtect v3.0 protected malware

I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...
0
votes
1answer
346 views

How can I circumvent rdtsc when used as an anti-debugger technique?

I using x86dbg and am working on unpacking a target. The unpacking stub appears to be using some anti-debugging techniques - most of which I can detour with a plugin. However, there are a lot of ...
0
votes
1answer
524 views

Working backwards from a popup

I'm currently trying to reverse engineer a game,but there's and anti-debug, so far the only leads I've tried to follow are: I found an IsDebuggerPresent API, I tried to change the value of EAX by ...
2
votes
1answer
4k views

Bypass IsDebuggerPresent

I have an address, that I think is not allowing me to run the debugger in IDA, I need help trying to stop it. Also , what does kernel32_IsDebuggerPresent mean?
0
votes
1answer
124 views

Help with anti-disassembly trick inside a hooked function

I am trying to understand a hook installed by a program within the Win32 API function ZwWriteVirtualMemory. It seems that a jmp inside an instruction is used and I couldn't fix it to be able to ...
4
votes
1answer
3k views

Detecting hardware breakpoints

Since software breakpoints, unlike hardware breakpoints , do change the code, it's relatively easy to write a program that performs a checksum on itself as an anti-debugger technique. Is it possible ...
2
votes
0answers
146 views

Anti-debug that can broke programm links (branches)?

I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image: ...
8
votes
1answer
3k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
0
votes
1answer
813 views

C++ Anti Kernel Debugger?

What are some things I can do to do anti kernel debugging from user-mode C++? I already use ZwQuerySystemInformation to query for SystemKernelDebuggerInformation.
-2
votes
1answer
199 views

Anti-Reverse Question on implementing a Shellcode

I am trying to make things harder for someone to reverse my code. I think that implementing a shellcode following this article could work for my case. How can I access (or share) global variables in ...
2
votes
2answers
2k views

Immunity debugger anti anti debug

I using Windows, and I was wondering what is the best anti anti debug plugin that exist, I tried to use hidedebug by Bob -> Team PEiD, but unfortunately it catch only the regular ways, I know that ...
2
votes
1answer
938 views

how to overcome setunhandledexceptionfilter in ollyDebugger?

I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this. Can you guys please explain the setunhandledexceptionfilter() anti-...
0
votes
2answers
148 views

Antidebug/reverse engineering targeted for libraries [closed]

So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables. Are there any resources that target specifically shared and ...
1
vote
1answer
1k views

how to bypass exception to debug EXE

i am trying to debug and find the encryption password algorithm in a Windows Application. Whenever i try to debug, setting a breakpoint or not, the application gives a exception: is it some kind of ...
0
votes
1answer
257 views

Is this anti-tamper solution fool-proof?

https://libreboot.org/faq/#intelme Introduced in June 2006 in Intel's 965 Express Chipset Family of (Graphics and) Memory Controller Hubs, or (G)MCHs, and the ICH8 I/O Controller Family, the Intel ...
1
vote
2answers
4k views

Getting past a whole lot of anti-debug measures for a windows exe

I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the ...
1
vote
1answer
1k views

how do I bypass ZwQueryInformationProcess as anti-debugging protection

How do I defeat the ZwQueryInformationProcess() anti-debugging protection for the ProcessDebugPort class? Unlike isDebuggerPresent() I found this really hard to bypass in my skill... Does anyone ...
1
vote
0answers
750 views

Immunity Debugger Unable to set Breakpoint

I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try. The first error is that Immunity is 'Unable ...
3
votes
1answer
487 views

Modifying PPID to avoid anti-debugging measure

I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits. To ...