Questions tagged [anti-debugging]

Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.

Filter by
Sorted by
Tagged with
3
votes
1answer
489 views

Modifying PPID to avoid anti-debugging measure

I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits. To ...
1
vote
1answer
881 views

Has anyone tried ptrace_attaching android unity apps for anti debugging?

I am trying to ptrace_attach the main process and its threads (/proc/<pid>/task) of an android unity app to avoid malicious users debugging the app(which is a game). I developed a ndk library ...
1
vote
1answer
354 views

What is the reason for INT 0x2D byte scission?

What is the reason behind the byte scission (the next immediate byte following "int 2d" is skipped) behaviour when executing INT 0x2D? I came across this article http://www.drdobbs.com/monitoring-nt-...
1
vote
3answers
283 views

What is the average time for “defusing” malware self-protection mechanisms?

I always wondered how much time is needed to get rid of all that anti-VM/crypto/protector/anti-debug stuff (without analyzing actual payload and purpose), especially if you're dealing with malware on ...
1
vote
1answer
192 views

Detect Debugger exploring Stack

I am interested in the following technique to detect if a debugger is attached or not. http://spareclockcycles.org/2012/02/14/stack-necromancy-defeating-debuggers-by-raising-the-dead/ However I ...
6
votes
3answers
2k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
3
votes
1answer
263 views

Self modifying codes

Recently I have found the article Using UPX as a Security Packer. Here, UPX is patched, after decompressing, also restores some overwritten bytes. This way, if somebody decompresses the binary with ...
0
votes
2answers
1k views

Detecting debugger with `rdtsc`

I am reading Eldad Eilam's book titled Reversing. In Chapter 11: Breaking Protections, there is a crackme called Defender, which creates a dedicated thread, which repeats the following steps: 1. ...
1
vote
0answers
236 views

An anti debug method on Linux [duplicate]

I have found this question (linux) How to debug a "debugger"? It is an anti debug technique, the parent creates a forked process and ptrace it. Now gdb can not attach top the child process. ...
0
votes
1answer
713 views

Hiding call to ptrace [duplicate]

I am trying to detect whether my executable is running in a debugger. Here is a solution using ptrace. My problem is that even if my executable is stripped (strip a.out) I am able to find with gdb the ...
3
votes
1answer
791 views

using GDB and dealing with breakpoint detection

I am trying to solve a reverse engineering challenge using using gdb. I can run the program inside it but when I set a breakpoint at main then I get Program received signal SIGSEGV, Segmentation ...
3
votes
1answer
2k views

Main Thread causes an exception - how to bypass that?

I analyze a piece of malware and I am faced with the following problem: The main thread of the malware spawns some threads. After the first thread is generated, the main thread jumps to a non-existent ...
2
votes
0answers
217 views

Malware analysis - AntiDebugging - Malware slows down the PC while being debugged

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution: Being executed Decrypt a lot of data from memory and obtain a new PE (from memory) Create a child ...
2
votes
0answers
469 views

Anti-dumping techniques [duplicate]

After handing on some crackmes using packed codes, I am now curious about anti-dumping techniques. For the crackmes I have encoutered, my method is as follows: after the program unpacks itself, I take ...
1
vote
0answers
3k views

A debugger has been found running in your system

For education reasons I just came into reverse engineering, so I found an app that I want to reverse. Basically it has a basic auth system (login and pass). I sniffed traffic with Wireshark and found ...
2
votes
1answer
2k views

Detection of OllyDbg - INT3? [closed]

I am trying to catch anti debugging routines, and I don't quite understand what INT3 does, and I have read that it can be used to detect debuggers and mask calls. The program eventually sends me into ...
1
vote
0answers
112 views

BSWAP and CMP as obfuscation for Anti-Debugging?

I am trying to attach debug a program that has an "anti-debug" feature on it. When stepping through, it seems to step through a maze of call and jmp commands that eventually just loop around. The ...
1
vote
2answers
620 views

Debugging Win32.Upatre - why does Ollydbg fail to analyze this?

So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze? And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog. I started analyzing ...
2
votes
2answers
1k views

How can I extend a memory of an analysed executable in IDA Pro?

I'm analysing some malware executable with ImmDBG and IDA Pro. The executable calls the kernel32.VirtualAlloc() at runtime with an argument lpAddress=NULL what means that an operating system decides ...
1
vote
1answer
683 views

How can I let IDA execute int 2D so that execution transfers to the exception handler function?

I'm reversing a program that dynamically loads SetUnhandledExceptionFilter and uses it to set a function as an exception handler. It then calls int 2D - so that execution transfers to the function ...
7
votes
2answers
4k views

How to bypass ZwContinue?

During an analysis, I have found a call to ZwContinue. The executable file first gets the address of ntdll.NtContinue and stores it in the EAX register. After I step over the following assembly line, ...
2
votes
1answer
2k views

Conflict of OllyDbg plugins

I have recently started using plugins for OllyDbg 1.10. Thanks to this site, I have an idea of the capabilities of the plugins for OllyDbg. As I have only a very basic idea of how plugins work, I ...
2
votes
0answers
199 views

Ollydbg Instructions Are Splitted

When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like; it should be e874010000 as a single instruction which is a call to some routine but it shows them like ...
7
votes
2answers
2k views

“Debugged application has modified the debugging registers” with ollydbg 2.01

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here: Debugged application has modified the debugging registers. Maybe it called ZwContinue() or ...
1
vote
3answers
417 views

Finding memory breakpoints from debugged executable

Is it possible to find Memory Breakpoints from within the debugged executable? (as an anti debugging technique?). And no, i do not mean Hardware Breakpoints from the Dr0 - Dr7 registers NOR INT3 \ ...
9
votes
1answer
2k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
0
votes
1answer
86 views

Where is the code for ollytlscatch?

I've been trying to get antiResHacker.exe as mentioned in this question: How to prevent use of Resource editors However, the codebase for ollytlscatch (https://code.google.com/p/ollytlscatch/) ...
4
votes
1answer
2k views

at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?

Hey i have a very time consuming problem, and i thought i might find someone here with better experience than mine that could help me out. I am reverse-engineering an application which at some point ...
2
votes
1answer
683 views

Decompile injected SWF in a specific environment

I am trying to reverse a swf file that is loaded into a AS3 application and executed by that application. The problem is that the injected file is obfuscated and no decompiler could manage to show me ...
2
votes
0answers
167 views

How can one debug a program that can only be started by other processes?

I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger. The program starts by using a bash script wrapper to process input parameters, ...
1
vote
1answer
2k views

Defeat QueryPerformanceCounter as Anti-Debugging trick

The sample I try to analyze starts with PUSHAD. It begins with: PUSHAD MOV ESI, unbr002.0109D000 LEA EDI, DWORD PTR DS:[ESI+FFEA4000] MOV DWORD PTR DS: [EDI+208C04], 8C1FE PUSH EDI ...
6
votes
2answers
1k views

(linux) How to debug a “debugger”?

I'm trying to understand a program. This programm implements an antidebug technique. From what I've understand so far, the father ptrace a forked process. An the child does something like that: ...
2
votes
2answers
579 views

Find sigtrap function

I'm reversing a program that uses a lot of BREAK/int 3 (Linux). I guess that the code contains something like: void sigtrap_func(int sig) { (some stuff..) } int main() { signal(SIGTRAP, ...
2
votes
2answers
8k views

Ollydbg and IDA Pro unable to attach to process

I have a target application protected with CrypKey. When i try to attach to the apps in OllyDbg and Ida Pro i receive Unable to attach to this process. The bad news is that i want to unpack the main ...
6
votes
1answer
2k views

Handling INT 2D anti-debugger technique in IDA Pro

I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging: CODE:00455050 push ebp CODE:00455051 mov ebp, esp CODE:00455053 push ecx CODE:00455054 push ebx ...
2
votes
3answers
1k views

ZwQueryInformationThread - what is it exactly?

By analyzing a piece of assembly code of a Trojan, I found a string "ZwQueryInformationThread". I assume that it is an anti-debugging technique because the process terminates after hitting that line. ...
5
votes
1answer
2k views

Why was my memory breakpoint not triggered in OllyDbg?

I am currently battling this protection on an 32-bit executable. At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
2
votes
0answers
374 views

What are the commercial anti reversing techniques? [closed]

I am interested in knowing about what are the latest commercial packages that are out there that deter reverse code engineering. And how do I work around them if necessary ? To be more specific I am ...
1
vote
2answers
2k views

Anti-cheat Memory Scan

The Problem I'm attaching a game's process to view/edit my ammo. I've reversed a few games and understand x86 assembly; however, I'm new to the whole anti-debuggers and memory scanning bit. I have ...
-2
votes
1answer
996 views

How does this test for debugger [closed]

While reading a book it mentioned that the following code is usually used to as an antidebugger mov eax, large fs:18h mov eax, [eax+30h] movzx eax, byte ptr [eax+2] retn I don't ...
-1
votes
1answer
1k views

How do memory integrity checks work?

How does a memory integrity check work? For example, the .code memory region is scanned by this check and then changes can be detected and the program will return with an event that will exit the ...
0
votes
1answer
470 views

HASP implementation details [closed]

I realize this is a huge question but any insight you can provide will be much appreciated. OK, let's consider a file protected/wrapped by HASP. What's the general layout of said file? There's a HASP ...
0
votes
4answers
211 views

What program can I use to detect protections used on a program and its libraries?

What are some good programs that can detect which protection software has been used on or in other programs and their libraries?
4
votes
1answer
92 views

registers set by function

How can I figure out which general-purpose registers are modified by a function call. I am programming a Win32 Assembly program that calls IsDebuggerPresent(). According to MSDN, it will return a ...
4
votes
1answer
626 views

OllyDbg FPU anti-debug

While playing around with FPU instructions I discovered an anti-debugging trick for OllyDbg. I haven't found it in popular references so far. First of all here it is. fnsave [esp-100h] cmp word ptr [...
1
vote
1answer
4k views

How to prevent application from killing OllyDbg

I want to run an OllyDbg and attach it to some starting later process. But the problem is, that process is very aggressive: it kills OllyDbg on start, and I also can't run OllyDbg later because that ...
12
votes
5answers
24k views

Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?

Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
2
votes
2answers
2k views

How to detect a debugger using some “time” checking strategies?

I have seen several anti-debug strategies, and I am wondering if there are some anti-debugger methods that can evaluate the program running time, thus detecting the exist of debugger.
2
votes
2answers
11k views

Bypassing basic memory protection

I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory. But ...
9
votes
2answers
1k views

What impact does noninvasive debugging have?

What impact does noninvasive user mode debugging with WinDbg have on the process? Will it be detectable by the process? Of course I could imagine that if the threads are suspended, differences in ...