Questions tagged [anti-debugging]

Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.

23 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
10
votes
1answer
2k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
3
votes
0answers
233 views

Instruction counting anti-debug

I recently came across this anti-debug technique being used in the wild. In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section A debugger will interfere ...
2
votes
0answers
149 views

Anti-debug that can broke programm links (branches)?

I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image: ...
2
votes
0answers
222 views

Malware analysis - AntiDebugging - Malware slows down the PC while being debugged

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution: Being executed Decrypt a lot of data from memory and obtain a new PE (from memory) Create a child ...
2
votes
0answers
208 views

Ollydbg Instructions Are Splitted

When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like; it should be e874010000 as a single instruction which is a call to some routine but it shows them like ...
2
votes
0answers
175 views

How can one debug a program that can only be started by other processes?

I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger. The program starts by using a bash script wrapper to process input parameters, ...
1
vote
0answers
61 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
1
vote
0answers
38 views

Is it possible to define the adress of a function in assembly?

I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc. Here is the PoC program : BITS 32 EXTERN ...
1
vote
0answers
238 views

How to virtualize part of a code like VMProtect does?

I am a new student in the field of cybersecurity. I would like to learn more about how virtualization used by software such as CodeVirtualizer and VMProtect works, and ideally to be able to ...
1
vote
0answers
106 views

Process terminating when breakpoint reached

I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
1
vote
0answers
223 views

Failed to set breakpoint (Anti-debug protection)

Sorry for my bad English in advance. There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
0answers
810 views

Immunity Debugger Unable to set Breakpoint

I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try. The first error is that Immunity is 'Unable ...
1
vote
0answers
3k views

A debugger has been found running in your system

For education reasons I just came into reverse engineering, so I found an app that I want to reverse. Basically it has a basic auth system (login and pass). I sniffed traffic with Wireshark and found ...
1
vote
0answers
117 views

BSWAP and CMP as obfuscation for Anti-Debugging?

I am trying to attach debug a program that has an "anti-debug" feature on it. When stepping through, it seems to step through a maze of call and jmp commands that eventually just loop around. The ...
0
votes
0answers
27 views

Debugged process not break on breakpoint

I launch a game process then I suspend the process and restore the hooks in ntdll.dll then I attach debugger to the process and resume the process. Next I see debugger catch the 0xC0000005(access ...
0
votes
0answers
75 views

Anti-re tactics or radare problem while debugging

Here's the target application: https://www.sa-mp.com/download.php While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
0
votes
0answers
31 views

How to disable macOS anti-debugging from within the process

I'd like to start lldb debugger on securityAgent process that is blocked by apple. It seems like this process is protected against debuggers, but perhaps there's a way to allow it from within a ...
0
votes
0answers
25 views

send screenshot to server if client is found under debug

if the client under debug detect there are some debugger attached, like throwing out single step exception, will it take a screenshot of my desktop then send to its server to prove that I am trying to ...
0
votes
0answers
174 views

Pe file Vmp0 vmp1 section,

I have a PE file with section vmp0 vmp1, possible protected with VMProtect. I am using local debugger in IDA pro, the program will detect the debugger and pop-up an message box and quit , I used the ...
0
votes
0answers
205 views

unpacking Armadillo-packed exe on Windows 10

I was trying to unpack the Armadillo-protected target from this webpage Armadillo 4.30a with Debug Blocker - manually unpacking on Windows 10. However, I got another child process spawning again after ...
0
votes
0answers
108 views

How to defeat fake rdtsc driver?

This RSE thread and this one discuss effectiveness of RDTSC-based anti-debug methods, and also a way to possibly work-around (albeit using a fake driver method, which is complex). What is a counter-...
0
votes
0answers
173 views

Advanced Anti-Debugging Techniques

I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like IsDebuggerPresent and CheckRemoteDebuggerPresent?
0
votes
0answers
241 views

debugger trap with angr

Let's suppose this (very ugly) c code: #include <stdio.h> #include <string.h> #include <signal.h> char sav_argv[100]; void on_sigtrap(int signo) { if (strcmp(sav_argv, "hello")...