27
ptrace can be detected by the fact that a process can only call ptrace once.
if ptrace() was already called by the strace executable or a debugger, we can detect it in runtime.
#include <stdio.h>
#include <sys/ptrace.h>
int main()
{
if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1)
{
printf("don't trace me !!\n");
return 1;
...
17
From my "Ultimate" Anti-Debugging reference (see pferrie.host22.com):
The interrupt 0x2D is a special case. When it is executed, Windows uses the current EIP register value as the exception address, and then it increments by one the EIP register value. However, Windows also examines the value in the EAX register to determine how to adjust the exception ...
17
The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit processes by calling 64bit versions of windows APIs) or by malware to make debugging more difficult, which is coincidentally what you seem to be experiencing ;)....
15
the list could be endless, so I'll keep it short:
virtualized environment artifacts: registry keys, hard disk name, network card address, specific drivers,...
environment differences: no mouse, internet connection, sound card,...
execution difference: detection of block translation (create another thread and apply statistics on IP), different system ...
15
There are a multitude of ways to detect virtual machines/emulators, mostly following the pattern of identifying an imperfection in the simulation and then testing for it.
At the simplest end, common virtualization toolkits plaster their name over all kinds of system drivers and devices. Simply looking at the name of network connections or their MAC address ...
14
I'm not sure if it's still around, but Themida used to have a kernel-mode driver component that facilitated some of the protection features. It could well be installed on your system and catching the debugger out.
My first suggestion would be to try Immunity Debugger. It's an Olly fork that is designed for offensive debugging and exploit development, but it ...
13
Apart from the ptrace trick, you can check /proc/PID/cmdline, raise a SIGTRAP, use getppid, ...
You may want to check pangu (disclamer: I'm the author).
Pangu a a little toolset to mess around with debugging-related tools
from the GNU project, and especially on GNU/Linux x86.
12
Here are some tricks for detecting VM's:
VirtualBox
http://pastebin.com/RU6A2UuB (9 different methods, registry, dropped VBOX dlls, pipe names etc)
http://pastebin.com/xhFABpPL (Machine provider name)
http://pastebin.com/v8LnMiZs (Innotek trick)
http://pastebin.com/fPY4MiYq (Bios Brand and Bios Version)
http://pastebin.com/Geggzp4G (Bios Brand and Bios ...
10
Let's have a look of the function's description in MSDN:
Determines whether the calling process is being debugged by a
user-mode debugger
As you guessed, this function is commonly used as an anti-debugging trick with the aim to break the process whenever the program detects that it is being debugged. IsDebuggerPresent checks for the BeingDebugged flag ...
9
ntdll!ZwContinue takes the same parameters than ntdll!NtContinue, that is the following :
NTSTATUS NTAPI
NtContinue (
IN PCONTEXT ThreadContext,
IN BOOLEAN RaiseAlert
);
You can read the "Eip" field in the PCONTEXT structure, put a breakpoint on this address, and press Run to reach your breakpoint and continue your analysis.
If you want to try Olly ...
8
It is effectively true that there is no additional impact. Non-invasive debugging is simply suspending the process, and then reading the register context and memory. Since there are no alterations to the memory, there isn't any physical thing to detect. The timing discrepancies that it introduces are detectable, but the same effects can be produced by a ...
8
This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that Hardware Breakpoints, as its name hints, are depends on the hardware you're running on and thus the implementation of such breakpoints is differ between each ...
8
VMProtect uses a few anti-debug techniques. Firstly, you aren't going to want to tackle them on your own because there is quite and exhaustive set of techniques to detect a debugger. Consider using an anti-anti-debug plugin (ScyllaHide)
One you are probably going to encounter that is difficult to work around is the rdtsc instruction.
rdtsc essentially ...
8
This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location.
ImageBase: The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, ...
7
This is pretty broad subject :-) There are several examples:
GetTickCount() - Retrieves the number of milliseconds that have elapsed since the system was started. Putting those in different parts of the program and then checking the difference can give you some primitive detection.
time() - Get the current calendar time.
RDTSC - Gets the current value of ...
7
Anti-attaching depends heavily on the fact that windows creates a remote thread in the target
process. What is specific about this thread is usually used to detect attaching.
For example:
The entry point Windows chooses for the attaching thread is by default the "DbgUiRemoteBreakin" function. Anti-attaching tricks usually hook this function or its
sibling, ...
7
Last Instruction Opcode is set mainly for the use of exception handlers, but it's set for every non-control FPU instruction (that is, set by loads, stores, compares, etc).
The value is non-zero on my system, but it is different value, and it's not constant.
Olly 1 doesn't request as many context fields as Olly 2 does, and that's part of the reason why the ...
7
The syntax is incorrect, but the code is basically what IsDebuggerPresent does.
Get a pointer to the TEB (located at fs:18h)
Get a pointer to the PEB (located at teb+30h)
Check the BeingDebugged flag (located at peb+2)
The syntax should be something like:
mov eax, large fs:18h
mov eax, [eax+30h]
movzx eax, byte ptr [eax+2]
If you don't ...
7
So how exactly do i figure out what is the remote process it is going
to communicate with, or what pipe it is using to communicate?
The first step is to find the RPC client interface. This can be found via the first argument to NdrClientCall2(), named pStubDescriptor. In your question, pStubDescriptor points to SspiCli!sspirpc_StubDesc:
And here is how ...
7
When a debugger wants to attach to a process it will do the following things (see the DebugActiveProcess implementation on ReactOS):
Connect to the debuggee with DbgUiConnectToDbg
Tell the kernel to start debugging the process with NtDebugActiveProcess
Issue a DbgBreakPoint in the attached-to process with DbgUiIssueRemoteBreakin
The DbgUiIssueRemoteBreakin ...
6
You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you want a 64 bit process, replace every x86 with x64):
Extract ScyllaHide (download) anywhere;
Run NtApiTool\x86\PDBReaderx86.exe and when it's finished, copy ...
6
Call NtSuspendProcess() on the child process.
Inject code into the parent process to call DebugActiveProcessStop() on the child process.
Attach your debugger to the child process.
Call NtResumeProcess() on the child process.
6
An Anti-Reverse Engineering Guide
And the primary explanatory comment from the code presented there.
// The Int2DCheck function will check to see if a debugger
// is attached to the current process. It does this by setting up
// SEH and using the Int 2D instruction which will only cause an
// exception if there is no debugger. Also when used in OllyDBG
// ...
6
I am not sure if plugins exist but you can write simple scripts like below to hide WinDbg on case to case basis.
Peb->BeingDebugged
r?$t0 = (ntdll!_peb *) @$peb;?? @$t0->BeingDebugged;eb (@$t0+2) 0;?? @$t0->BeingDebugged
ZwSetInformationThread (XP SP3 syscalls with sysenter)
bp ntdll!ZwSetInformationThread "r eip = $ip+0n12 ; r eax = 0; gc"
...
6
In general, this concept is referred to as register preservation or register volatility.
From http://en.wikipedia.org/wiki/X86_calling_conventions#Register_preservation --
According to the Intel ABI to which the vast majority of compilers
conform, the EAX, EDX, and ECX are to be free for use within a
procedure or function, and need not be preserved.
...
6
That's where strace comes in handy. If i make your program compilable and compile it:
$cat trap.c
#include <signal.h>
void sigtrap_func(int sig) { puts("trap"); }
int main()
{
signal(SIGTRAP, sigtrap_func);
}
$ cc -o trap trap.c
and then run it with strace, i'll get a list of all system calls the program executes:
$strace -i ./trap
[ ...
6
Here are a few links that address your question in a broad manner:
VMAttack: Deobfuscating Virtualization-Based Packed Binaries
Link to PDF Paper which uses the VMAttack IDA PRO Plugin.
Unpacking Virtualization Obfuscators by Rolf Rolles.
Unpacking the FinSpy VM, parts #1, #2, #3
Various other articles by Rolf Rolles .
5
It is possible the ways the other commenters suggested. However, all of them are interceptable, if you read a file, it can be intercepted and your program will be given different result, if you check if LD_PRELOAD is set, it can be unset before you can reach out to it, etc. Suid is another story, though, but there may be different ways of exploiting it too.
5
I wrote a test program a while go (in Delphi).
The following two functions detect VMware and HyperV
// VMware detection as described by Elias Bachaalany
function IsInsideVMware: Boolean;
begin
Result := True;
try
asm
push edx;
push ecx;
push ebx;
mov eax, 'VMXh';
mov ebx, 0;
mov ecx, 10;
mov edx, 'VX';
...
5
The code is expecting an exception to occur, which will happen in the absence of a debugger. If a debugger is present, the breakpoint exception will usually be suppressed by the debugger, and execution will continue at either 0x455067 or 0x455068, depending on the debugger.
You have two simple choices: one choice is that you could just let execution reach ...
Only top voted, non community-wiki answers of a minimum length are eligible
