25
ptrace can be detected by the fact that a process can only call ptrace once.
if ptrace() was already called by the strace executable or a debugger, we can detect it in runtime.
#include <stdio.h>
#include <sys/ptrace.h>
int main()
{
if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1)
{
printf("don't trace me !!\n");
return 1;
...
20
Here's some I've seen or heard about:
Stripping the section headers. A simple and fully legal action that stops GDB dead in its tracks. Does not work against some other debuggers (e.g. IDA). Can be done using the sstrip tool.
Using syscall function or direct syscalls instructions instead of calling specific functions like ptrace(). Can be defeated by ...
17
The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit processes by calling 64bit versions of windows APIs) or by malware to make debugging more difficult, which is coincidentally what you seem to be experiencing ;)....
16
From my "Ultimate" Anti-Debugging reference (see pferrie.host22.com):
The interrupt 0x2D is a special case. When it is executed, Windows uses the current EIP register value as the exception address, and then it increments by one the EIP register value. However, Windows also examines the value in the EAX register to determine how to adjust the exception ...
15
the list could be endless, so I'll keep it short:
virtualized environment artifacts: registry keys, hard disk name, network card address, specific drivers,...
environment differences: no mouse, internet connection, sound card,...
execution difference: detection of block translation (create another thread and apply statistics on IP), different system ...
15
There are a multitude of ways to detect virtual machines/emulators, mostly following the pattern of identifying an imperfection in the simulation and then testing for it.
At the simplest end, common virtualization toolkits plaster their name over all kinds of system drivers and devices. Simply looking at the name of network connections or their MAC address ...
14
I'm not sure if it's still around, but Themida used to have a kernel-mode driver component that facilitated some of the protection features. It could well be installed on your system and catching the debugger out.
My first suggestion would be to try Immunity Debugger. It's an Olly fork that is designed for offensive debugging and exploit development, but it ...
13
Apart from the ptrace trick, you can check /proc/PID/cmdline, raise a SIGTRAP, use getppid, ...
You may want to check pangu (disclamer: I'm the author).
Pangu a a little toolset to mess around with debugging-related tools
from the GNU project, and especially on GNU/Linux x86.
13
Peter Ferrie's “Ultimate” Anti-Debugging Reference (PDF, 147 pages) contains many anti-debugs, whether they're hardware or API based...
Walied Assar's blog shows his researches, which are focused on finding new anti-debugs.
other (maybe redundant) resources:
Nicolas Fallière's Windows Anti-Debug reference
OpenRCE's Anti Reverse Engineering Techniques ...
10
Here are some tricks for detecting VM's:
VirtualBox
http://pastebin.com/RU6A2UuB (9 different methods, registry, dropped VBOX dlls, pipe names etc)
http://pastebin.com/xhFABpPL (Machine provider name)
http://pastebin.com/v8LnMiZs (Innotek trick)
http://pastebin.com/fPY4MiYq (Bios Brand and Bios Version)
http://pastebin.com/Geggzp4G (Bios Brand and Bios ...
9
My understanding of anti-debugging technology is that it is a game of cat and mouse (or cat and also cat). A technique works until it is understood by the opposing side and then it doesn't work any more. I think that ultimately the advantage is on the side of the debugger. Consider dynamic binary instrumentation or virtual machine systems. You can detect the ...
9
Let's have a look of the function's description in MSDN:
Determines whether the calling process is being debugged by a
user-mode debugger
As you guessed, this function is commonly used as an anti-debugging trick with the aim to break the process whenever the program detects that it is being debugged. IsDebuggerPresent checks for the BeingDebugged flag ...
8
It is effectively true that there is no additional impact. Non-invasive debugging is simply suspending the process, and then reading the register context and memory. Since there are no alterations to the memory, there isn't any physical thing to detect. The timing discrepancies that it introduces are detectable, but the same effects can be produced by a ...
7
Anti-attaching depends heavily on the fact that windows creates a remote thread in the target
process. What is specific about this thread is usually used to detect attaching.
For example:
The entry point Windows chooses for the attaching thread is by default the "DbgUiRemoteBreakin" function. Anti-attaching tricks usually hook this function or its
sibling, ...
7
This is pretty broad subject :-) There are several examples:
GetTickCount() - Retrieves the number of milliseconds that have elapsed since the system was started. Putting those in different parts of the program and then checking the difference can give you some primitive detection.
time() - Get the current calendar time.
RDTSC - Gets the current value of ...
7
Last Instruction Opcode is set mainly for the use of exception handlers, but it's set for every non-control FPU instruction (that is, set by loads, stores, compares, etc).
The value is non-zero on my system, but it is different value, and it's not constant.
Olly 1 doesn't request as many context fields as Olly 2 does, and that's part of the reason why the ...
7
The syntax is incorrect, but the code is basically what IsDebuggerPresent does.
Get a pointer to the TEB (located at fs:18h)
Get a pointer to the PEB (located at teb+30h)
Check the BeingDebugged flag (located at peb+2)
The syntax should be something like:
mov eax, large fs:18h
mov eax, [eax+30h]
movzx eax, byte ptr [eax+2]
If you don't ...
7
So how exactly do i figure out what is the remote process it is going
to communicate with, or what pipe it is using to communicate?
The first step is to find the RPC client interface. This can be found via the first argument to NdrClientCall2(), named pStubDescriptor. In your question, pStubDescriptor points to SspiCli!sspirpc_StubDesc:
And here is how ...
6
You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you want a 64 bit process, replace every x86 with x64):
Extract ScyllaHide (download) anywhere;
Run NtApiTool\x86\PDBReaderx86.exe and when it's finished, copy ...
6
Call NtSuspendProcess() on the child process.
Inject code into the parent process to call DebugActiveProcessStop() on the child process.
Attach your debugger to the child process.
Call NtResumeProcess() on the child process.
6
I am not sure if plugins exist but you can write simple scripts like below to hide WinDbg on case to case basis.
Peb->BeingDebugged
r?$t0 = (ntdll!_peb *) @$peb;?? @$t0->BeingDebugged;eb (@$t0+2) 0;?? @$t0->BeingDebugged
ZwSetInformationThread (XP SP3 syscalls with sysenter)
bp ntdll!ZwSetInformationThread "r eip = $ip+0n12 ; r eax = 0; gc"
...
6
SetWindowsHookEx isn't really used for this sort of hooking as far as I'm aware.
You could hook NtSetInformationThread in the import of the binary you want to analyze and make it always return success on ThreadHideFromDebugger but not forward the call to the actual function. This would be weak since GetProcAddress or manual imports would bypass it.
You ...
6
An Anti-Reverse Engineering Guide
And the primary explanatory comment from the code presented there.
// The Int2DCheck function will check to see if a debugger
// is attached to the current process. It does this by setting up
// SEH and using the Int 2D instruction which will only cause an
// exception if there is no debugger. Also when used in OllyDBG
// ...
6
In general, this concept is referred to as register preservation or register volatility.
From http://en.wikipedia.org/wiki/X86_calling_conventions#Register_preservation --
According to the Intel ABI to which the vast majority of compilers
conform, the EAX, EDX, and ECX are to be free for use within a
procedure or function, and need not be preserved.
...
6
ntdll!ZwContinue takes the same parameters than ntdll!NtContinue, that is the following :
NTSTATUS NTAPI
NtContinue (
IN PCONTEXT ThreadContext,
IN BOOLEAN RaiseAlert
);
You can read the "Eip" field in the PCONTEXT structure, put a breakpoint on this address, and press Run to reach your breakpoint and continue your analysis.
If you want to try Olly ...
6
Here are a few links that address your question in a broad manner:
VMAttack: Deobfuscating Virtualization-Based Packed Binaries
Link to PDF Paper which uses the VMAttack IDA PRO Plugin.
Unpacking Virtualization Obfuscators by Rolf Rolles.
Unpacking the FinSpy VM, parts #1, #2, #3
Various other articles by Rolf Rolles .
5
I wrote a test program a while go (in Delphi).
The following two functions detect VMware and HyperV
// VMware detection as described by Elias Bachaalany
function IsInsideVMware: Boolean;
begin
Result := True;
try
asm
push edx;
push ecx;
push ebx;
mov eax, 'VMXh';
mov ebx, 0;
mov ecx, 10;
mov edx, 'VX';
...
5
The code is expecting an exception to occur, which will happen in the absence of a debugger. If a debugger is present, the breakpoint exception will usually be suppressed by the debugger, and execution will continue at either 0x455067 or 0x455068, depending on the debugger.
You have two simple choices: one choice is that you could just let execution reach ...
5
That's where strace comes in handy. If i make your program compilable and compile it:
$cat trap.c
#include <signal.h>
void sigtrap_func(int sig) { puts("trap"); }
int main()
{
signal(SIGTRAP, sigtrap_func);
}
$ cc -o trap trap.c
and then run it with strace, i'll get a list of all system calls the program executes:
$strace -i ./trap
[ ...
answered Oct 14 '14 at 15:12
Guntram Blohm supports Monica
11.6k1 gold badge15 silver badges31 bronze badges
5
You can use something like Scylla Hide
https://github.com/nihilus/ScyllaHide
It has plugins for most popular debuggers. It has lots of hiding options and presets for advanced packers like Themida.
You can also try Titan Hide.
https://github.com/mrexodia/TitanHide
Only top voted, non community-wiki answers of a minimum length are eligible
