Questions tagged [anti-debugging]

Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.

Filter by
Sorted by
Tagged with
19
votes
8answers
23k views

How to detect a virtualized environment?

What are the different ways for a program to detect that it executes inside a virtualized environment ? And, would it be possible to detect what kind of virtualization is used ?
18
votes
3answers
16k views

Detecting tracing in Linux

Under Linux it's possible to trace exactly the kernel system calls with strace. ltrace can be used also to trace library calls. I wonder if it's possible to detect if my executable is running under ...
18
votes
3answers
4k views

Anti-debug techniques on Unix platforms?

I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more). I am thinking about techniques such as the PTRACE test at the beginning of ...
13
votes
4answers
5k views

INT 2D Anti-Forensic Method

Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
13
votes
4answers
5k views

Debugger hiding plugin for WinDbg?

Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
12
votes
5answers
26k views

Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?

Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
10
votes
1answer
2k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
9
votes
2answers
5k views

How to bypass ZwContinue?

During an analysis, I have found a call to ZwContinue. The executable file first gets the address of ntdll.NtContinue and stores it in the EAX register. After I step over the following assembly line, ...
9
votes
2answers
1k views

What impact does noninvasive debugging have?

What impact does noninvasive user mode debugging with WinDbg have on the process? Will it be detectable by the process? Of course I could imagine that if the threads are suspended, differences in ...
8
votes
1answer
3k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
7
votes
2answers
2k views

How to Attach debugger or start analysis of process that is debugging itself?

I need and advice on how to start an analysis, connect with debugger to a process that is already debugging itself. Are there any tools/plugins/techniques that might help during the analysis? UPDATE ...
7
votes
2answers
2k views

“Debugged application has modified the debugging registers” with ollydbg 2.01

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here: Debugged application has modified the debugging registers. Maybe it called ZwContinue() or ...
6
votes
3answers
2k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
6
votes
1answer
763 views

Canonical method to circumvent the ZwSetInformationThread antidebugging technique

I'm sure many of you are familiar with this classic antidebug trick accomplished by calling ZwSetInformationThread with ThreadInformationClass set to 0x11. Although many OllyDbg modules exist for the ...
6
votes
1answer
2k views

Handling INT 2D anti-debugger technique in IDA Pro

I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging: CODE:00455050 push ebp CODE:00455051 mov ebp, esp CODE:00455053 push ecx CODE:00455054 push ebx ...
6
votes
2answers
1k views

(linux) How to debug a “debugger”?

I'm trying to understand a program. This programm implements an antidebug technique. From what I've understand so far, the father ptrace a forked process. An the child does something like that: ...
5
votes
1answer
8k views

How to attach debugger to app if it has protection against attaching?

Sometimes I've tried to attach Ollydbg to applications those have some protection against debuggers, but I have never coded any of these applications and did not see this protection in many ...
5
votes
1answer
5k views

Detecting hardware breakpoints

Since software breakpoints, unlike hardware breakpoints , do change the code, it's relatively easy to write a program that performs a checksum on itself as an anti-debugger technique. Is it possible ...
5
votes
1answer
3k views

Why was my memory breakpoint not triggered in OllyDbg?

I am currently battling this protection on an 32-bit executable. At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
4
votes
1answer
2k views

What are good Windows anti-debug references? [closed]

What are good anti-debug references for Windows which help with manual unpacking, emulating, or sandboxing?
4
votes
4answers
16k views

Finding OEP in a VMProtect v3.0 protected malware

I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...
4
votes
1answer
112 views

Why does PE ImageBase address change in memory?

I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
4
votes
1answer
3k views

at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?

Hey i have a very time consuming problem, and i thought i might find someone here with better experience than mine that could help me out. I am reverse-engineering an application which at some point ...
4
votes
1answer
651 views

OllyDbg FPU anti-debug

While playing around with FPU instructions I discovered an anti-debugging trick for OllyDbg. I haven't found it in popular references so far. First of all here it is. fnsave [esp-100h] cmp word ptr [...
4
votes
1answer
92 views

registers set by function

How can I figure out which general-purpose registers are modified by a function call. I am programming a Win32 Assembly program that calls IsDebuggerPresent(). According to MSDN, it will return a ...
3
votes
1answer
2k views

VMProtect anti-debug method

I recently found a nice crackme which uses VMProtect 3.x as defense. After doing a little research online I found couple of API's VMProtect uses as an anti debug method. I set software breakpoint on ...
3
votes
1answer
1k views

Thread EntryPoint in TLS callback as AntiDebug technique

I came across a document called The Ultimate Anti-Reversing Reference, which describes various Anti-Debugging techniques. in point 4.Thread Local Storage There is a mention Thread Local Storage ...
3
votes
1answer
285 views

Self modifying codes

Recently I have found the article Using UPX as a Security Packer. Here, UPX is patched, after decompressing, also restores some overwritten bytes. This way, if somebody decompresses the binary with ...
3
votes
1answer
2k views

Main Thread causes an exception - how to bypass that?

I analyze a piece of malware and I am faced with the following problem: The main thread of the malware spawns some threads. After the first thread is generated, the main thread jumps to a non-existent ...
3
votes
1answer
3k views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
3
votes
1answer
501 views

Modifying PPID to avoid anti-debugging measure

I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits. To ...
3
votes
1answer
909 views

using GDB and dealing with breakpoint detection

I am trying to solve a reverse engineering challenge using using gdb. I can run the program inside it but when I set a breakpoint at main then I get Program received signal SIGSEGV, Segmentation ...
3
votes
0answers
245 views

Instruction counting anti-debug

I recently came across this anti-debug technique being used in the wild. In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section A debugger will interfere ...
2
votes
2answers
2k views

How to detect a debugger using some “time” checking strategies?

I have seen several anti-debug strategies, and I am wondering if there are some anti-debugger methods that can evaluate the program running time, thus detecting the exist of debugger.
2
votes
3answers
297 views

What is the average time for “defusing” malware self-protection mechanisms?

I always wondered how much time is needed to get rid of all that anti-VM/crypto/protector/anti-debug stuff (without analyzing actual payload and purpose), especially if you're dealing with malware on ...
2
votes
1answer
7k views

Bypass IsDebuggerPresent

I have an address, that I think is not allowing me to run the debugger in IDA, I need help trying to stop it. Also , what does kernel32_IsDebuggerPresent mean?
2
votes
2answers
666 views

Find sigtrap function

I'm reversing a program that uses a lot of BREAK/int 3 (Linux). I guess that the code contains something like: void sigtrap_func(int sig) { (some stuff..) } int main() { signal(SIGTRAP, ...
2
votes
1answer
1k views

how to overcome setunhandledexceptionfilter in ollyDebugger?

I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this. Can you guys please explain the setunhandledexceptionfilter() anti-...
2
votes
1answer
463 views

What is __sighandler_t struct and purpose of SIGTRAP signal handler

I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value : .text:08048063 ...
2
votes
1answer
3k views

Detection of OllyDbg - INT3? [closed]

I am trying to catch anti debugging routines, and I don't quite understand what INT3 does, and I have read that it can be used to detect debuggers and mask calls. The program eventually sends me into ...
2
votes
2answers
9k views

Ollydbg and IDA Pro unable to attach to process

I have a target application protected with CrypKey. When i try to attach to the apps in OllyDbg and Ida Pro i receive Unable to attach to this process. The bad news is that i want to unpack the main ...
2
votes
1answer
100 views

Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff

I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it. Pretext: ...
2
votes
3answers
339 views

Debug program using peculiar anti-debugging technique

In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques. One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
2
votes
2answers
438 views

Jump in the middle trick

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
2
votes
2answers
1k views

How can I extend a memory of an analysed executable in IDA Pro?

I'm analysing some malware executable with ImmDBG and IDA Pro. The executable calls the kernel32.VirtualAlloc() at runtime with an argument lpAddress=NULL what means that an operating system decides ...
2
votes
3answers
1k views

ZwQueryInformationThread - what is it exactly?

By analyzing a piece of assembly code of a Trojan, I found a string "ZwQueryInformationThread". I assume that it is an anti-debugging technique because the process terminates after hitting that line. ...
2
votes
1answer
197 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
2
votes
1answer
949 views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...
2
votes
1answer
2k views

Conflict of OllyDbg plugins

I have recently started using plugins for OllyDbg 1.10. Thanks to this site, I have an idea of the capabilities of the plugins for OllyDbg. As I have only a very basic idea of how plugins work, I ...
2
votes
2answers
11k views

Bypassing basic memory protection

I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory. But ...