Questions tagged [anti-debugging]

Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment.

Filter by
Sorted by
Tagged with
2
votes
0answers
379 views

What are the commercial anti reversing techniques? [closed]

I am interested in knowing about what are the latest commercial packages that are out there that deter reverse code engineering. And how do I work around them if necessary ? To be more specific I am ...
1
vote
2answers
2k views

Anti-cheat Memory Scan

The Problem I'm attaching a game's process to view/edit my ammo. I've reversed a few games and understand x86 assembly; however, I'm new to the whole anti-debuggers and memory scanning bit. I have ...
-2
votes
1answer
1k views

How does this test for debugger [closed]

While reading a book it mentioned that the following code is usually used to as an antidebugger mov eax, large fs:18h mov eax, [eax+30h] movzx eax, byte ptr [eax+2] retn I don't ...
-1
votes
1answer
1k views

How do memory integrity checks work?

How does a memory integrity check work? For example, the .code memory region is scanned by this check and then changes can be detected and the program will return with an event that will exit the ...
0
votes
1answer
492 views

HASP implementation details [closed]

I realize this is a huge question but any insight you can provide will be much appreciated. OK, let's consider a file protected/wrapped by HASP. What's the general layout of said file? There's a HASP ...
0
votes
4answers
215 views

What program can I use to detect protections used on a program and its libraries?

What are some good programs that can detect which protection software has been used on or in other programs and their libraries?
4
votes
1answer
92 views

registers set by function

How can I figure out which general-purpose registers are modified by a function call. I am programming a Win32 Assembly program that calls IsDebuggerPresent(). According to MSDN, it will return a ...
4
votes
1answer
641 views

OllyDbg FPU anti-debug

While playing around with FPU instructions I discovered an anti-debugging trick for OllyDbg. I haven't found it in popular references so far. First of all here it is. fnsave [esp-100h] cmp word ptr [...
1
vote
1answer
4k views

How to prevent application from killing OllyDbg

I want to run an OllyDbg and attach it to some starting later process. But the problem is, that process is very aggressive: it kills OllyDbg on start, and I also can't run OllyDbg later because that ...
12
votes
5answers
26k views

Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?

Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
2
votes
2answers
2k views

How to detect a debugger using some “time” checking strategies?

I have seen several anti-debug strategies, and I am wondering if there are some anti-debugger methods that can evaluate the program running time, thus detecting the exist of debugger.
2
votes
2answers
11k views

Bypassing basic memory protection

I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory. But ...
9
votes
2answers
1k views

What impact does noninvasive debugging have?

What impact does noninvasive user mode debugging with WinDbg have on the process? Will it be detectable by the process? Of course I could imagine that if the threads are suspended, differences in ...
5
votes
1answer
8k views

How to attach debugger to app if it has protection against attaching?

Sometimes I've tried to attach Ollydbg to applications those have some protection against debuggers, but I have never coded any of these applications and did not see this protection in many ...
7
votes
2answers
2k views

How to Attach debugger or start analysis of process that is debugging itself?

I need and advice on how to start an analysis, connect with debugger to a process that is already debugging itself. Are there any tools/plugins/techniques that might help during the analysis? UPDATE ...
1
vote
1answer
2k views

How can I tell if an app is using anti-debug techniques? [closed]

How can I detect whether an application is using anti-debug techniques? I'm using OllyDbg (2.01beta).
1
vote
1answer
561 views

Find out decrypted body of Polymorphic malware

I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its ...
13
votes
4answers
5k views

Debugger hiding plugin for WinDbg?

Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
18
votes
3answers
16k views

Detecting tracing in Linux

Under Linux it's possible to trace exactly the kernel system calls with strace. ltrace can be used also to trace library calls. I wonder if it's possible to detect if my executable is running under ...
19
votes
8answers
22k views

How to detect a virtualized environment?

What are the different ways for a program to detect that it executes inside a virtualized environment ? And, would it be possible to detect what kind of virtualization is used ?
13
votes
4answers
5k views

INT 2D Anti-Forensic Method

Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
4
votes
1answer
2k views

What are good Windows anti-debug references? [closed]

What are good anti-debug references for Windows which help with manual unpacking, emulating, or sandboxing?
6
votes
1answer
751 views

Canonical method to circumvent the ZwSetInformationThread antidebugging technique

I'm sure many of you are familiar with this classic antidebug trick accomplished by calling ZwSetInformationThread with ThreadInformationClass set to 0x11. Although many OllyDbg modules exist for the ...
18
votes
2answers
4k views

Anti-debug techniques on Unix platforms?

I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more). I am thinking about techniques such as the PTRACE test at the beginning of ...

1 2
3