18
votes
Accepted
How to investigate Windows 32/64bit (WOW64) transition
The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
- 11.4k
10
votes
Accepted
Bypass IsDebuggerPresent
Let's have a look of the function's description in MSDN:
Determines whether the calling process is being debugged by a
user-mode debugger
As you guessed, this function is commonly used as an ...
- 8,649
9
votes
Accepted
at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?
So how exactly do i figure out what is the remote process it is going
to communicate with, or what pipe it is using to communicate?
The first step is to find the RPC client interface. This can be ...
- 20.4k
9
votes
How to bypass ZwContinue?
ntdll!ZwContinue takes the same parameters than ntdll!NtContinue, that is the following :
NTSTATUS NTAPI
NtContinue (
IN PCONTEXT ThreadContext,
IN BOOLEAN RaiseAlert
);
You can read the "Eip" ...
- 578
9
votes
Accepted
Detecting hardware breakpoints
This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that ...
- 8,649
9
votes
VMProtect anti-debug method
VMProtect uses a few anti-debug techniques. Firstly, you aren't going to want to tackle them on your own because there is quite and exhaustive set of techniques to detect a debugger. Consider using an ...
- 253
9
votes
Why does PE ImageBase address change in memory?
This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location.
ImageBase: The preferred address of the first byte of image when loaded into ...
- 4,552
8
votes
Accepted
How does this test for debugger
The syntax is incorrect, but the code is basically what IsDebuggerPresent does.
Get a pointer to the TEB (located at fs:18h)
Get a pointer to the PEB (located at teb+30h)
Check the BeingDebugged flag ...
- 1,561
7
votes
Accepted
Thread EntryPoint in TLS callback as AntiDebug technique
When a debugger wants to attach to a process it will do the following things (see the DebugActiveProcess implementation on ReactOS):
Connect to the debuggee with DbgUiConnectToDbg
Tell the kernel to ...
- 1,602
6
votes
Accepted
Find sigtrap function
That's where strace comes in handy. If i make your program compilable and compile it:
$cat trap.c
#include <signal.h>
void sigtrap_func(int sig) { puts("trap"); }
int main()
{
signal(SIGTRAP,...
- 12.7k
6
votes
Debugger hiding plugin for WinDbg?
You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you ...
- 1,602
6
votes
How to bypass ZwContinue?
Check the context argument to NtContinue (first arg). NtContinue works as an anti-debug by potentially clearing DR7 or breaking out of single stepping by clearing the trap flag, then returning to the ...
- 261
6
votes
Accepted
Finding OEP in a VMProtect v3.0 protected malware
Here are a few links that address your question in a broad manner:
VMAttack: Deobfuscating Virtualization-Based Packed Binaries
Link to PDF Paper which uses the VMAttack IDA PRO Plugin.
Unpacking ...
- 136
5
votes
Accepted
Handling INT 2D anti-debugger technique in IDA Pro
The code is expecting an exception to occur, which will happen in the absence of a debugger. If a debugger is present, the breakpoint exception will usually be suppressed by the debugger, and ...
- 4,511
5
votes
Detecting tracing in Linux
It is possible the ways the other commenters suggested. However, all of them are interceptable, if you read a file, it can be intercepted and your program will be given different result, if you check ...
- 51
5
votes
Debugging forked child in an anti-debug protected crackme
Use dbg.forks=true to stop the debugger when a fork happens. and then just use dp to list and select the pid you want to follow.
- 377
5
votes
What is the average time for "defusing" malware self-protection mechanisms?
I work in AV industry for about a year now and I can tell you how I see this. How fast can you get rid of certain anti-reversing techniques depends on your experience and will to learn and understand ...
- 1,043
5
votes
Accepted
Getting past a whole lot of anti-debug measures for a windows exe
You can use something like Scylla Hide
https://github.com/nihilus/ScyllaHide
It has plugins for most popular debuggers. It has lots of hiding options and presets for advanced packers like Themida.
...
- 220
5
votes
how to overcome setunhandledexceptionfilter in ollyDebugger?
TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program.
A more detailed ...
- 11.4k
5
votes
Working backwards from a popup
The error you've received was probably thrown by either Themida or WinLicense, a well known protectors. I'd say here that fully bypass of both Themida and WinLicense are goals that are hard to reach ...
- 8,649
5
votes
Jump in the middle trick
Yes, this is indeed possible to employ consistently throughout the entire assembly listing, making manual analysis or adjustments a pain.
Disassemblers are often divided into two categories:
linear ...
- 11.4k
4
votes
Defeat QueryPerformanceCounter as Anti-Debugging trick
.....
CALL DWORD PTR DS:[109407C] kernel32.GetSystemTimeAsFileTime
MOV ESI, DWORD PTR SS:[EBP-4]
XOR ESI, DWORD PTR SS:[EBP-8]
CALL DWORD PTR DS:[10940F4] kernel32.GetCurrentProcessId
...
- 20.4k
4
votes
Accepted
Detection of OllyDbg - INT3?
This technique uses the fact that when the interrupt instructions INT3 (breakpoint) and INT1
(single-step) are stepped thru inside a debugger, by default, the exception handler will not be
invoked ...
- 314
4
votes
Self modifying codes
If I want to protect my binary from disassembling, does the second
method has any disadvantage compared to the first one?
The second method requires that you have access to the source code¹, ...
- 20.4k
4
votes
Accepted
Anti-Reverse Question on implementing a Shellcode
Writing a shellcode is often a task considerably more difficult than developing a piece of software. To me it seems your assumption about developing your program as a shellcode is incorrect and will ...
- 11.4k
4
votes
Accepted
What is __sighandler_t struct and purpose of SIGTRAP signal handler
First, am I right to think that the purpose of this is to create a
handler for the SIGTRAP signal, probably in order to prevent any
debuger use
When a SIGTRAP is raised, normally the handler ...
- 1,074
3
votes
Accepted
Ollydbg and IDA Pro unable to attach to process
Debug the loader.
Set a breakpoint on CreateProcess (or ZwCreateProcess if needed)
When the breakpoint is hit modify the process creation flags on the stack to include CREATE_SUSPENDED.
Make sure ...
- 5,860
3
votes
(linux) How to debug a "debugger"?
You can break on the ptrace, bypass it, set it return value as if it was succesfuly called, use two instances of GDB: one for the child, and one for the father.
- 2,486
3
votes
How to detect a virtualized environment?
Here is a collection of anti-sandbox/vm/debugger techniques implemented in a open source program which will give you a clear idea how to detect virtualization: https://github.com/LordNoteworthy/al-...
- 141
3
votes
INT 2D Anti-Forensic Method
The interrupt 0x2D is a special case. When it is executed, Windows
uses the current EIP register value as the exception address, and then
it increments by one the EIP register value. However, ...
- 31
Only top scored, non community-wiki answers of a minimum length are eligible