18 votes
Accepted

How to investigate Windows 32/64bit (WOW64) transition

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
NirIzr's user avatar
  • 11.8k
11 votes
Accepted

Bypass IsDebuggerPresent

Let's have a look of the function's description in MSDN: Determines whether the calling process is being debugged by a user-mode debugger As you guessed, this function is commonly used as an ...
Megabeets's user avatar
  • 8,959
9 votes
Accepted

Detecting hardware breakpoints

This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that ...
Megabeets's user avatar
  • 8,959
9 votes

VMProtect anti-debug method

VMProtect uses a few anti-debug techniques. Firstly, you aren't going to want to tackle them on your own because there is quite and exhaustive set of techniques to detect a debugger. Consider using an ...
Jeremy's user avatar
  • 263
9 votes

Why does PE ImageBase address change in memory?

This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location. ImageBase: The preferred address of the first byte of image when loaded into ...
Paweł Łukasik's user avatar
7 votes
Accepted

Thread EntryPoint in TLS callback as AntiDebug technique

When a debugger wants to attach to a process it will do the following things (see the DebugActiveProcess implementation on ReactOS): Connect to the debuggee with DbgUiConnectToDbg Tell the kernel to ...
mrexodia's user avatar
  • 1,652
6 votes

Debugger hiding plugin for WinDbg?

You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you ...
mrexodia's user avatar
  • 1,652
6 votes

Debugging forked child in an anti-debug protected crackme

Use dbg.forks=true to stop the debugger when a fork happens. and then just use dp to list and select the pid you want to follow.
pancake's user avatar
  • 482
6 votes
Accepted

Finding OEP in a VMProtect v3.0 protected malware

Here are a few links that address your question in a broad manner: VMAttack: Deobfuscating Virtualization-Based Packed Binaries Link to PDF Paper which uses the VMAttack IDA PRO Plugin. Unpacking ...
PeterG's user avatar
  • 136
5 votes

Working backwards from a popup

The error you've received was probably thrown by either Themida or WinLicense, a well known protectors. I'd say here that fully bypass of both Themida and WinLicense are goals that are hard to reach ...
Megabeets's user avatar
  • 8,959
5 votes

how to overcome setunhandledexceptionfilter in ollyDebugger?

TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program. A more detailed ...
NirIzr's user avatar
  • 11.8k
5 votes

What is the average time for "defusing" malware self-protection mechanisms?

I work in AV industry for about a year now and I can tell you how I see this. How fast can you get rid of certain anti-reversing techniques depends on your experience and will to learn and understand ...
ubnix's user avatar
  • 1,063
5 votes
Accepted

Getting past a whole lot of anti-debug measures for a windows exe

You can use something like Scylla Hide https://github.com/nihilus/ScyllaHide It has plugins for most popular debuggers. It has lots of hiding options and presets for advanced packers like Themida. ...
Ghassan Idriss's user avatar
5 votes

Jump in the middle trick

Yes, this is indeed possible to employ consistently throughout the entire assembly listing, making manual analysis or adjustments a pain. Disassemblers are often divided into two categories: linear ...
NirIzr's user avatar
  • 11.8k
4 votes

Debugging forked child in an anti-debug protected crackme

The first thing with radare2 is to make sure that you're running the latest git version. To get help about commands in radare2, you can use the ? character. For help about configuration variables, ...
jvoisin's user avatar
  • 2,506
4 votes

Self modifying codes

If I want to protect my binary from disassembling, does the second method has any disadvantage compared to the first one? The second method requires that you have access to the source code¹, ...
Jason Geffner's user avatar
4 votes
Accepted

Anti-Reverse Question on implementing a Shellcode

Writing a shellcode is often a task considerably more difficult than developing a piece of software. To me it seems your assumption about developing your program as a shellcode is incorrect and will ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

What is __sighandler_t struct and purpose of SIGTRAP signal handler

First, am I right to think that the purpose of this is to create a handler for the SIGTRAP signal, probably in order to prevent any debuger use When a SIGTRAP is raised, normally the handler ...
wisk's user avatar
  • 1,124
4 votes

Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff

I think that the code is supposed to be checking for hooks. The adr instruction sets x8 to the start of the function so if there was a breakpoint or a jump placed there by a hook library, the byte ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes

C++ Anti Kernel Debugger?

There is little you can do to prevent/detect kernel mode debugging of your application from user mode. Even if you can detect, it's because no one is interested enough to by-pass them. For example, ...
PhoeniX's user avatar
  • 3,022
3 votes
Accepted

how to bypass exception to debug EXE

It seems this exception is used to set the thread name for the debugger. You should be able to safely ignore it.
Igor Skochinsky's user avatar
  • 36.5k
3 votes
Accepted

What is the average time for "defusing" malware self-protection mechanisms?

Based on a couple of years of performing and teaching (Malware Bootcamp at University of Bonn, Germany) reverse engineering with focus on malware analysis, I mostly try to skip any "easy" stepping ...
pnX's user avatar
  • 416
3 votes

How to detect a virtualized environment?

Here is a collection of anti-sandbox/vm/debugger techniques implemented in a open source program which will give you a clear idea how to detect virtualization: https://github.com/LordNoteworthy/al-...
Noteworthy's user avatar
3 votes

Anti-debug techniques on Unix platforms?

They aren't any, do not try to do the mathematically impossible. For now, all the techniques I found on Internet were easily worked around as soon as the anti-debug technique has been understood. So, ...
12431234123412341234123's user avatar
3 votes

Finding OEP in a VMProtect v3.0 protected malware

Set a breakpoint on the "VM exit" instruction (though there may be more than one of these if the sample is using the multiple VM option, whose proper name I don't recall). From here you can see where ...
Rolf Rolles's user avatar
  • 9,198
3 votes

How to fix anti-debugger with DbgUiRemoteBreakin

This is not anti-debug but the standard way the Win32 debugging API implements process attaching. The thread with DbgBreakPoint call is injected by the OS to ensure that the process gets stopped, ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes
Accepted

Searching for a sequence of bytes in IDA

Of course you can't find it in the crackme, because the code isn't there. It's easy to determine which file the code belongs to: It's KERNELBA, so it probably comes from a system dll (KERNELBASE.dll?)...
user202729's user avatar
3 votes

Anti-disassembler techniques and IDA Pro

I think you may face what's called a rogue-byte. I'm currently scripting something to patch them (see IDAPython - Find the start of an undefined code blob). Can you tell me if it's the same type of ...
Guillaume's user avatar
  • 709
3 votes

Debug program using peculiar anti-debugging technique

This technique is equivalent to the Structured Exception Handler for Windows. The application registers an exception handler, then forces an exception to occur, thereby transferring control to the ...
peter ferrie's user avatar
  • 4,699
2 votes

Debugger hiding plugin for WinDbg?

Here you can download QEMU virtual machine with embedded WinDbg stub: https://github.com/ispras/qemu/releases https://github.com/ispras/qemu/tree/windbg This stub allows debugging with WinDbg without ...
Pavel Dovgalyuk's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible