Questions tagged [anti-debugging]

Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.

Filter by
Sorted by
Tagged with
19
votes
8answers
21k views

How to detect a virtualized environment?

What are the different ways for a program to detect that it executes inside a virtualized environment ? And, would it be possible to detect what kind of virtualization is used ?
18
votes
3answers
15k views

Detecting tracing in Linux

Under Linux it's possible to trace exactly the kernel system calls with strace. ltrace can be used also to trace library calls. I wonder if it's possible to detect if my executable is running under ...
18
votes
2answers
3k views

Anti-debug techniques on Unix platforms?

I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more). I am thinking about techniques such as the PTRACE test at the beginning of ...
13
votes
4answers
4k views

INT 2D Anti-Forensic Method

Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
13
votes
4answers
4k views

Debugger hiding plugin for WinDbg?

Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
12
votes
5answers
24k views

Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?

Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
9
votes
2answers
1k views

What impact does noninvasive debugging have?

What impact does noninvasive user mode debugging with WinDbg have on the process? Will it be detectable by the process? Of course I could imagine that if the threads are suspended, differences in ...
8
votes
1answer
3k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
7
votes
2answers
4k views

How to bypass ZwContinue?

During an analysis, I have found a call to ZwContinue. The executable file first gets the address of ntdll.NtContinue and stores it in the EAX register. After I step over the following assembly line, ...
7
votes
2answers
1k views

How to Attach debugger or start analysis of process that is debugging itself?

I need and advice on how to start an analysis, connect with debugger to a process that is already debugging itself. Are there any tools/plugins/techniques that might help during the analysis? UPDATE ...
7
votes
2answers
2k views

“Debugged application has modified the debugging registers” with ollydbg 2.01

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here: Debugged application has modified the debugging registers. Maybe it called ZwContinue() or ...
6
votes
3answers
2k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
6
votes
1answer
672 views

Canonical method to circumvent the ZwSetInformationThread antidebugging technique

I'm sure many of you are familiar with this classic antidebug trick accomplished by calling ZwSetInformationThread with ThreadInformationClass set to 0x11. Although many OllyDbg modules exist for the ...
6
votes
1answer
2k views

Handling INT 2D anti-debugger technique in IDA Pro

I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging: CODE:00455050 push ebp CODE:00455051 mov ebp, esp CODE:00455053 push ecx CODE:00455054 push ebx ...
6
votes
2answers
1k views

(linux) How to debug a “debugger”?

I'm trying to understand a program. This programm implements an antidebug technique. From what I've understand so far, the father ptrace a forked process. An the child does something like that: ...
6
votes
1answer
2k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
5
votes
1answer
8k views

How to attach debugger to app if it has protection against attaching?

Sometimes I've tried to attach Ollydbg to applications those have some protection against debuggers, but I have never coded any of these applications and did not see this protection in many ...
5
votes
1answer
2k views

Why was my memory breakpoint not triggered in OllyDbg?

I am currently battling this protection on an 32-bit executable. At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
4
votes
1answer
2k views

What are good Windows anti-debug references? [closed]

What are good anti-debug references for Windows which help with manual unpacking, emulating, or sandboxing?
4
votes
4answers
12k views

Finding OEP in a VMProtect v3.0 protected malware

I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...
4
votes
1answer
2k views

at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?

Hey i have a very time consuming problem, and i thought i might find someone here with better experience than mine that could help me out. I am reverse-engineering an application which at some point ...
4
votes
1answer
622 views

OllyDbg FPU anti-debug

While playing around with FPU instructions I discovered an anti-debugging trick for OllyDbg. I haven't found it in popular references so far. First of all here it is. fnsave [esp-100h] cmp word ptr [...
4
votes
1answer
92 views

registers set by function

How can I figure out which general-purpose registers are modified by a function call. I am programming a Win32 Assembly program that calls IsDebuggerPresent(). According to MSDN, it will return a ...
4
votes
1answer
3k views

Detecting hardware breakpoints

Since software breakpoints, unlike hardware breakpoints , do change the code, it's relatively easy to write a program that performs a checksum on itself as an anti-debugger technique. Is it possible ...
3
votes
1answer
633 views

Thread EntryPoint in TLS callback as AntiDebug technique

I came across a document called The Ultimate Anti-Reversing Reference, which describes various Anti-Debugging techniques. in point 4.Thread Local Storage There is a mention Thread Local Storage ...
3
votes
1answer
259 views

Self modifying codes

Recently I have found the article Using UPX as a Security Packer. Here, UPX is patched, after decompressing, also restores some overwritten bytes. This way, if somebody decompresses the binary with ...
3
votes
1answer
2k views

Main Thread causes an exception - how to bypass that?

I analyze a piece of malware and I am faced with the following problem: The main thread of the malware spawns some threads. After the first thread is generated, the main thread jumps to a non-existent ...
3
votes
1answer
2k views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
3
votes
1answer
488 views

Modifying PPID to avoid anti-debugging measure

I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits. To ...
3
votes
1answer
762 views

using GDB and dealing with breakpoint detection

I am trying to solve a reverse engineering challenge using using gdb. I can run the program inside it but when I set a breakpoint at main then I get Program received signal SIGSEGV, Segmentation ...
3
votes
0answers
175 views

Instruction counting anti-debug

I recently came across this anti-debug technique being used in the wild. In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section A debugger will interfere ...
2
votes
2answers
2k views

How to detect a debugger using some “time” checking strategies?

I have seen several anti-debug strategies, and I am wondering if there are some anti-debugger methods that can evaluate the program running time, thus detecting the exist of debugger.
2
votes
1answer
4k views

Bypass IsDebuggerPresent

I have an address, that I think is not allowing me to run the debugger in IDA, I need help trying to stop it. Also , what does kernel32_IsDebuggerPresent mean?
2
votes
2answers
568 views

Find sigtrap function

I'm reversing a program that uses a lot of BREAK/int 3 (Linux). I guess that the code contains something like: void sigtrap_func(int sig) { (some stuff..) } int main() { signal(SIGTRAP, ...
2
votes
1answer
939 views

how to overcome setunhandledexceptionfilter in ollyDebugger?

I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this. Can you guys please explain the setunhandledexceptionfilter() anti-...
2
votes
1answer
176 views

What is __sighandler_t struct and purpose of SIGTRAP signal handler

I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value : .text:08048063 ...
2
votes
1answer
751 views

VMProtect anti-debug method

I recently found a nice crackme which uses VMProtect 3.x as defense. After doing a little research online I found couple of API's VMProtect uses as an anti debug method. I set software breakpoint on ...
2
votes
1answer
2k views

Detection of OllyDbg - INT3? [closed]

I am trying to catch anti debugging routines, and I don't quite understand what INT3 does, and I have read that it can be used to detect debuggers and mask calls. The program eventually sends me into ...
2
votes
2answers
8k views

Ollydbg and IDA Pro unable to attach to process

I have a target application protected with CrypKey. When i try to attach to the apps in OllyDbg and Ida Pro i receive Unable to attach to this process. The bad news is that i want to unpack the main ...
2
votes
2answers
175 views

Debug program using peculiar anti-debugging technique

In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques. One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
2
votes
2answers
221 views

Jump in the middle trick

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
2
votes
2answers
1k views

How can I extend a memory of an analysed executable in IDA Pro?

I'm analysing some malware executable with ImmDBG and IDA Pro. The executable calls the kernel32.VirtualAlloc() at runtime with an argument lpAddress=NULL what means that an operating system decides ...
2
votes
3answers
1k views

ZwQueryInformationThread - what is it exactly?

By analyzing a piece of assembly code of a Trojan, I found a string "ZwQueryInformationThread". I assume that it is an anti-debugging technique because the process terminates after hitting that line. ...
2
votes
1answer
128 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
2
votes
1answer
560 views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...
2
votes
1answer
2k views

Conflict of OllyDbg plugins

I have recently started using plugins for OllyDbg 1.10. Thanks to this site, I have an idea of the capabilities of the plugins for OllyDbg. As I have only a very basic idea of how plugins work, I ...
2
votes
2answers
11k views

Bypassing basic memory protection

I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory. But ...
2
votes
1answer
98 views

dongle check happen before a debugger start debugging

i'm trying to fake the test ( dongle exist ) but one problem that i encounter is that the application detect it before i start debugging it . this is what happen with more details : open( not ...
2
votes
2answers
2k views

Immunity debugger anti anti debug

I using Windows, and I was wondering what is the best anti anti debug plugin that exist, I tried to use hidedebug by Bob -> Team PEiD, but unfortunately it catch only the regular ways, I know that ...
2
votes
1answer
674 views

Decompile injected SWF in a specific environment

I am trying to reverse a swf file that is loaded into a AS3 application and executed by that application. The problem is that the injected file is obfuscated and no decompiler could manage to show me ...