Questions tagged [anti-debugging]
Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.
140 questions
22
votes
3
answers
19k
views
Detecting tracing in Linux
Under Linux it's possible to trace exactly the kernel system calls with strace.
ltrace can be used also to trace library calls.
I wonder if it's possible to detect if my executable is running under ...
- 4,845
22
votes
3
answers
6k
views
Anti-debug techniques on Unix platforms?
I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more).
I am thinking about techniques such as the PTRACE test at the beginning of ...
- 19.2k
19
votes
8
answers
28k
views
How to detect a virtualized environment?
What are the different ways for a program to detect that it executes inside a virtualized environment ? And, would it be possible to detect what kind of virtualization is used ?
- 19.2k
16
votes
4
answers
7k
views
INT 2D Anti-Forensic Method
Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
- 263
14
votes
4
answers
7k
views
Debugger hiding plugin for WinDbg?
Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
- 685
12
votes
5
answers
29k
views
Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?
Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
- 223
10
votes
2
answers
8k
views
How to bypass ZwContinue?
During an analysis, I have found a call to ZwContinue. The executable file first gets the address of ntdll.NtContinue and stores it in the EAX register.
After I step over the following assembly line, ...
- 1,541
10
votes
2
answers
1k
views
What impact does noninvasive debugging have?
What impact does noninvasive user mode debugging with WinDbg have on the process?
Will it be detectable by the process?
Of course I could imagine that if the threads are suspended, differences in ...
- 970
10
votes
1
answer
3k
views
Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?
I'm debugging this process which has a lot of anti debugging techniques in it, and I faced something new which I don't know how to bypass yet.
Changing the code dynamically causes exceptions to occur ...
- 668
8
votes
1
answer
5k
views
How to investigate Windows 32/64bit (WOW64) transition
There is surprisingly little information about Windows WOW64 mechanism.
I'm trying to investigate it.
So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
- 273
8
votes
1
answer
7k
views
Detecting hardware breakpoints
Since software breakpoints, unlike hardware breakpoints , do change the code, it's relatively easy to write a program that performs a checksum on itself as an anti-debugger technique. Is it possible ...
- 437
8
votes
2
answers
2k
views
How to Attach debugger or start analysis of process that is debugging itself?
I need and advice on how to start an analysis, connect with debugger to a process that is already debugging itself. Are there any tools/plugins/techniques that might help during the analysis?
UPDATE
...
- 3,072
8
votes
1
answer
919
views
Canonical method to circumvent the ZwSetInformationThread antidebugging technique
I'm sure many of you are familiar with this classic antidebug trick accomplished by calling ZwSetInformationThread with ThreadInformationClass set to 0x11. Although many OllyDbg modules exist for the ...
- 1,213
7
votes
3
answers
4k
views
Debugging forked child in an anti-debug protected crackme
I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
- 897
7
votes
1
answer
4k
views
at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?
Hey i have a very time consuming problem, and i thought i might find someone here with better experience than mine that could help me out.
I am reverse-engineering an application which at some point ...
- 668
7
votes
2
answers
2k
views
"Debugged application has modified the debugging registers" with ollydbg 2.01
I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here:
Debugged application has modified the debugging registers.
Maybe it called ZwContinue() or ...
- 1,541
6
votes
1
answer
2k
views
Why does PE ImageBase address change in memory?
I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
- 61
6
votes
1
answer
9k
views
How to attach debugger to app if it has protection against attaching?
Sometimes I've tried to attach Ollydbg to applications those have some protection against debuggers, but I have never coded any of these applications and did not see this protection in many ...
- 261
6
votes
1
answer
2k
views
Handling INT 2D anti-debugger technique in IDA Pro
I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging:
CODE:00455050 push ebp
CODE:00455051 mov ebp, esp
CODE:00455053 push ecx
CODE:00455054 push ebx
...
- 235
6
votes
2
answers
2k
views
(linux) How to debug a "debugger"?
I'm trying to understand a program. This programm implements an antidebug technique.
From what I've understand so far, the father ptrace a forked process.
An the child does something like that:
...
- 121
5
votes
1
answer
2k
views
What are good Windows anti-debug references? [closed]
What are good anti-debug references for Windows which help with manual unpacking, emulating, or sandboxing?
- 6,704
5
votes
1
answer
769
views
OllyDbg FPU anti-debug
While playing around with FPU instructions I discovered an anti-debugging trick for
OllyDbg. I haven't found it in popular references so far.
First of all here it is.
fnsave [esp-100h]
cmp word ptr [...
5
votes
1
answer
4k
views
Why was my memory breakpoint not triggered in OllyDbg?
I am currently battling this protection on an 32-bit executable.
At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
- 181
5
votes
0
answers
398
views
Instruction counting anti-debug
I recently came across this anti-debug technique being used in the wild.
In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section
A debugger will interfere ...
- 180
4
votes
4
answers
21k
views
Finding OEP in a VMProtect v3.0 protected malware
I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...
- 395
4
votes
1
answer
5k
views
Thread EntryPoint in TLS callback as AntiDebug technique
I came across a document called The Ultimate Anti-Reversing Reference, which describes various Anti-Debugging techniques. in point 4.Thread Local Storage There is a mention
Thread Local Storage ...
- 153
4
votes
1
answer
99
views
registers set by function
How can I figure out which general-purpose registers are modified by a function call. I am programming a Win32 Assembly program that calls IsDebuggerPresent(). According to MSDN, it will return a ...
- 113
4
votes
1
answer
5k
views
How to fix anti-debugger with DbgUiRemoteBreakin
I have windows application that I want to debug.
When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint
when I press Play I see
...
- 41
3
votes
2
answers
3k
views
How to detect a debugger using some "time" checking strategies?
I have seen several anti-debug strategies, and I am wondering if there are some anti-debugger methods that can evaluate the program running time, thus detecting the exist of debugger.
- 2,485
3
votes
1
answer
5k
views
VMProtect anti-debug method
I recently found a nice crackme which uses VMProtect 3.x as defense.
After doing a little research online I found couple of API's VMProtect uses as an anti debug method.
I set software breakpoint on ...
- 31
3
votes
2
answers
2k
views
Jump in the middle trick
I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
3
votes
3
answers
2k
views
Debug program using peculiar anti-debugging technique
In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques.
One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
- 3,419
3
votes
2
answers
1k
views
Guidelines for dealing with obfuscated code
I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
- 145
3
votes
1
answer
351
views
Self modifying codes
Recently I have found the article Using UPX as a Security Packer. Here, UPX is patched, after decompressing, also restores some overwritten bytes. This way, if somebody decompresses the binary with ...
- 897
3
votes
1
answer
2k
views
Anti-disassembler techniques and IDA Pro
I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having ...
- 161
3
votes
1
answer
3k
views
Main Thread causes an exception - how to bypass that?
I analyze a piece of malware and I am faced with the following problem: The main thread of the malware spawns some threads. After the first thread is generated, the main thread jumps to a non-existent ...
- 1,541
3
votes
2
answers
12k
views
Bypassing basic memory protection
I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory.
But ...
- 139
3
votes
1
answer
1k
views
VMProtect Anti-debugging method (without WiNAPI)
First, sorry for my bad english.
I'm trying to make VMProtect unpacker with unicorn emulator, but one of my sample shows me like this anti-debugging message:
WTSSendMessageW: "A debugger has been ...
- 63
3
votes
1
answer
588
views
Modifying PPID to avoid anti-debugging measure
I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits.
To ...
- 219
3
votes
1
answer
1k
views
using GDB and dealing with breakpoint detection
I am trying to solve a reverse engineering challenge using using gdb. I can run the program inside it but when I set a breakpoint at main then I get
Program received signal SIGSEGV, Segmentation ...
- 115
3
votes
0
answers
365
views
Weird anti-debugging mechanism
I am trying to grasp an anti-debugging trick used in this program. Upon attaching any debugger (x64dbg, VEH debugger) the software crashes after about 2 seconds.
x64dbg shows me that the following ...
- 151
3
votes
0
answers
179
views
Anti-debug that can broke programm links (branches)?
I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image:
...
- 31
3
votes
0
answers
279
views
Malware analysis - AntiDebugging - Malware slows down the PC while being debugged
As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution:
Being executed
Decrypt a lot of data from memory and obtain a new PE (from memory)
Create a child ...
- 668
2
votes
1
answer
16k
views
Bypass IsDebuggerPresent
I have an address, that I think is not allowing me to run the debugger in IDA, I need help trying to stop it.
Also , what does kernel32_IsDebuggerPresent mean?
- 107
2
votes
3
answers
325
views
What is the average time for "defusing" malware self-protection mechanisms?
I always wondered how much time is needed to get rid of all that anti-VM/crypto/protector/anti-debug stuff (without analyzing actual payload and purpose), especially if you're dealing with malware on ...
- 53
2
votes
2
answers
970
views
Find sigtrap function
I'm reversing a program that uses a lot of BREAK/int 3 (Linux). I guess that the code contains something like:
void sigtrap_func(int sig) { (some stuff..) }
int main()
{
signal(SIGTRAP, ...
- 23
2
votes
1
answer
2k
views
how to overcome setunhandledexceptionfilter in ollyDebugger?
I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this.
Can you guys please explain the setunhandledexceptionfilter() anti-...
- 121
2
votes
1
answer
5k
views
How to prevent application from killing OllyDbg
I want to run an OllyDbg and attach it to some starting later process.
But the problem is, that process is very aggressive: it kills OllyDbg on start, and I also can't run OllyDbg later because that ...
- 453
2
votes
1
answer
278
views
Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff
I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it.
Pretext:
...
- 21
2
votes
1
answer
2k
views
What is __sighandler_t struct and purpose of SIGTRAP signal handler
I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value :
.text:08048063 ...
- 283