26
ptrace can be detected by the fact that a process can only call ptrace once.
if ptrace() was already called by the strace executable or a debugger, we can detect it in runtime.
#include <stdio.h>
#include <sys/ptrace.h>
int main()
{
if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1)
{
printf("don't trace me !!\n");
return 1;
...
20
Here's some I've seen or heard about:
Stripping the section headers. A simple and fully legal action that stops GDB dead in its tracks. Does not work against some other debuggers (e.g. IDA). Can be done using the sstrip tool.
Using syscall function or direct syscalls instructions instead of calling specific functions like ptrace(). Can be defeated by ...
17
The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit processes by calling 64bit versions of windows APIs) or by malware to make debugging more difficult, which is coincidentally what you seem to be experiencing ;)....
16
From my "Ultimate" Anti-Debugging reference (see pferrie.host22.com):
The interrupt 0x2D is a special case. When it is executed, Windows uses the current EIP register value as the exception address, and then it increments by one the EIP register value. However, Windows also examines the value in the EAX register to determine how to adjust the exception ...
15
the list could be endless, so I'll keep it short:
virtualized environment artifacts: registry keys, hard disk name, network card address, specific drivers,...
environment differences: no mouse, internet connection, sound card,...
execution difference: detection of block translation (create another thread and apply statistics on IP), different system ...
15
There are a multitude of ways to detect virtual machines/emulators, mostly following the pattern of identifying an imperfection in the simulation and then testing for it.
At the simplest end, common virtualization toolkits plaster their name over all kinds of system drivers and devices. Simply looking at the name of network connections or their MAC address ...
14
I'm not sure if it's still around, but Themida used to have a kernel-mode driver component that facilitated some of the protection features. It could well be installed on your system and catching the debugger out.
My first suggestion would be to try Immunity Debugger. It's an Olly fork that is designed for offensive debugging and exploit development, but it ...
13
Apart from the ptrace trick, you can check /proc/PID/cmdline, raise a SIGTRAP, use getppid, ...
You may want to check pangu (disclamer: I'm the author).
Pangu a a little toolset to mess around with debugging-related tools
from the GNU project, and especially on GNU/Linux x86.
13
Peter Ferrie's “Ultimate” Anti-Debugging Reference (PDF, 147 pages) contains many anti-debugs, whether they're hardware or API based...
Walied Assar's blog shows his researches, which are focused on finding new anti-debugs.
other (maybe redundant) resources:
Nicolas Fallière's Windows Anti-Debug reference
OpenRCE's Anti Reverse Engineering Techniques ...
12
Here are some tricks for detecting VM's:
VirtualBox
http://pastebin.com/RU6A2UuB (9 different methods, registry, dropped VBOX dlls, pipe names etc)
http://pastebin.com/xhFABpPL (Machine provider name)
http://pastebin.com/v8LnMiZs (Innotek trick)
http://pastebin.com/fPY4MiYq (Bios Brand and Bios Version)
http://pastebin.com/Geggzp4G (Bios Brand and Bios ...
9
My understanding of anti-debugging technology is that it is a game of cat and mouse (or cat and also cat). A technique works until it is understood by the opposing side and then it doesn't work any more. I think that ultimately the advantage is on the side of the debugger. Consider dynamic binary instrumentation or virtual machine systems. You can detect the ...
9
ntdll!ZwContinue takes the same parameters than ntdll!NtContinue, that is the following :
NTSTATUS NTAPI
NtContinue (
IN PCONTEXT ThreadContext,
IN BOOLEAN RaiseAlert
);
You can read the "Eip" field in the PCONTEXT structure, put a breakpoint on this address, and press Run to reach your breakpoint and continue your analysis.
If you want to try Olly ...
9
Let's have a look of the function's description in MSDN:
Determines whether the calling process is being debugged by a
user-mode debugger
As you guessed, this function is commonly used as an anti-debugging trick with the aim to break the process whenever the program detects that it is being debugged. IsDebuggerPresent checks for the BeingDebugged flag ...
8
It is effectively true that there is no additional impact. Non-invasive debugging is simply suspending the process, and then reading the register context and memory. Since there are no alterations to the memory, there isn't any physical thing to detect. The timing discrepancies that it introduces are detectable, but the same effects can be produced by a ...
8
This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that Hardware Breakpoints, as its name hints, are depends on the hardware you're running on and thus the implementation of such breakpoints is differ between each ...
7
Anti-attaching depends heavily on the fact that windows creates a remote thread in the target
process. What is specific about this thread is usually used to detect attaching.
For example:
The entry point Windows chooses for the attaching thread is by default the "DbgUiRemoteBreakin" function. Anti-attaching tricks usually hook this function or its
sibling, ...
7
This is pretty broad subject :-) There are several examples:
GetTickCount() - Retrieves the number of milliseconds that have elapsed since the system was started. Putting those in different parts of the program and then checking the difference can give you some primitive detection.
time() - Get the current calendar time.
RDTSC - Gets the current value of ...
7
Last Instruction Opcode is set mainly for the use of exception handlers, but it's set for every non-control FPU instruction (that is, set by loads, stores, compares, etc).
The value is non-zero on my system, but it is different value, and it's not constant.
Olly 1 doesn't request as many context fields as Olly 2 does, and that's part of the reason why the ...
7
The syntax is incorrect, but the code is basically what IsDebuggerPresent does.
Get a pointer to the TEB (located at fs:18h)
Get a pointer to the PEB (located at teb+30h)
Check the BeingDebugged flag (located at peb+2)
The syntax should be something like:
mov eax, large fs:18h
mov eax, [eax+30h]
movzx eax, byte ptr [eax+2]
If you don't ...
7
So how exactly do i figure out what is the remote process it is going
to communicate with, or what pipe it is using to communicate?
The first step is to find the RPC client interface. This can be found via the first argument to NdrClientCall2(), named pStubDescriptor. In your question, pStubDescriptor points to SspiCli!sspirpc_StubDesc:
And here is how ...
7
VMProtect uses a few anti-debug techniques. Firstly, you aren't going to want to tackle them on your own because there is quite and exhaustive set of techniques to detect a debugger. Consider using an anti-anti-debug plugin (ScyllaHide)
One you are probably going to encounter that is difficult to work around is the rdtsc instruction.
rdtsc essentially ...
7
This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location.
ImageBase: The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, ...
6
You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you want a 64 bit process, replace every x86 with x64):
Extract ScyllaHide (download) anywhere;
Run NtApiTool\x86\PDBReaderx86.exe and when it's finished, copy ...
6
Call NtSuspendProcess() on the child process.
Inject code into the parent process to call DebugActiveProcessStop() on the child process.
Attach your debugger to the child process.
Call NtResumeProcess() on the child process.
6
I am not sure if plugins exist but you can write simple scripts like below to hide WinDbg on case to case basis.
Peb->BeingDebugged
r?$t0 = (ntdll!_peb *) @$peb;?? @$t0->BeingDebugged;eb (@$t0+2) 0;?? @$t0->BeingDebugged
ZwSetInformationThread (XP SP3 syscalls with sysenter)
bp ntdll!ZwSetInformationThread "r eip = $ip+0n12 ; r eax = 0; gc"
...
6
SetWindowsHookEx isn't really used for this sort of hooking as far as I'm aware.
You could hook NtSetInformationThread in the import of the binary you want to analyze and make it always return success on ThreadHideFromDebugger but not forward the call to the actual function. This would be weak since GetProcAddress or manual imports would bypass it.
You ...
6
An Anti-Reverse Engineering Guide
And the primary explanatory comment from the code presented there.
// The Int2DCheck function will check to see if a debugger
// is attached to the current process. It does this by setting up
// SEH and using the Int 2D instruction which will only cause an
// exception if there is no debugger. Also when used in OllyDBG
// ...
6
In general, this concept is referred to as register preservation or register volatility.
From http://en.wikipedia.org/wiki/X86_calling_conventions#Register_preservation --
According to the Intel ABI to which the vast majority of compilers
conform, the EAX, EDX, and ECX are to be free for use within a
procedure or function, and need not be preserved.
...
6
That's where strace comes in handy. If i make your program compilable and compile it:
$cat trap.c
#include <signal.h>
void sigtrap_func(int sig) { puts("trap"); }
int main()
{
signal(SIGTRAP, sigtrap_func);
}
$ cc -o trap trap.c
and then run it with strace, i'll get a list of all system calls the program executes:
$strace -i ./trap
[ ...
6
Here are a few links that address your question in a broad manner:
VMAttack: Deobfuscating Virtualization-Based Packed Binaries
Link to PDF Paper which uses the VMAttack IDA PRO Plugin.
Unpacking Virtualization Obfuscators by Rolf Rolles.
Unpacking the FinSpy VM, parts #1, #2, #3
Various other articles by Rolf Rolles .
Only top voted, non community-wiki answers of a minimum length are eligible
