17
The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit processes by calling 64bit versions of windows APIs) or by malware to make debugging more difficult, which is coincidentally what you seem to be experiencing ;)....
14
I'm not sure if it's still around, but Themida used to have a kernel-mode driver component that facilitated some of the protection features. It could well be installed on your system and catching the debugger out.
My first suggestion would be to try Immunity Debugger. It's an Olly fork that is designed for offensive debugging and exploit development, but it ...
10
Let's have a look of the function's description in MSDN:
Determines whether the calling process is being debugged by a
user-mode debugger
As you guessed, this function is commonly used as an anti-debugging trick with the aim to break the process whenever the program detects that it is being debugged. IsDebuggerPresent checks for the BeingDebugged flag ...
9
ntdll!ZwContinue takes the same parameters than ntdll!NtContinue, that is the following :
NTSTATUS NTAPI
NtContinue (
IN PCONTEXT ThreadContext,
IN BOOLEAN RaiseAlert
);
You can read the "Eip" field in the PCONTEXT structure, put a breakpoint on this address, and press Run to reach your breakpoint and continue your analysis.
If you want to try Olly ...
8
It is effectively true that there is no additional impact. Non-invasive debugging is simply suspending the process, and then reading the register context and memory. Since there are no alterations to the memory, there isn't any physical thing to detect. The timing discrepancies that it introduces are detectable, but the same effects can be produced by a ...
8
Anti-attaching depends heavily on the fact that windows creates a remote thread in the target
process. What is specific about this thread is usually used to detect attaching.
For example:
The entry point Windows chooses for the attaching thread is by default the "DbgUiRemoteBreakin" function. Anti-attaching tricks usually hook this function or its
sibling, ...
8
This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that Hardware Breakpoints, as its name hints, are depends on the hardware you're running on and thus the implementation of such breakpoints is differ between each ...
8
VMProtect uses a few anti-debug techniques. Firstly, you aren't going to want to tackle them on your own because there is quite and exhaustive set of techniques to detect a debugger. Consider using an anti-anti-debug plugin (ScyllaHide)
One you are probably going to encounter that is difficult to work around is the rdtsc instruction.
rdtsc essentially ...
8
This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location.
ImageBase: The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, ...
7
This is pretty broad subject :-) There are several examples:
GetTickCount() - Retrieves the number of milliseconds that have elapsed since the system was started. Putting those in different parts of the program and then checking the difference can give you some primitive detection.
time() - Get the current calendar time.
RDTSC - Gets the current value of ...
7
Last Instruction Opcode is set mainly for the use of exception handlers, but it's set for every non-control FPU instruction (that is, set by loads, stores, compares, etc).
The value is non-zero on my system, but it is different value, and it's not constant.
Olly 1 doesn't request as many context fields as Olly 2 does, and that's part of the reason why the ...
7
The syntax is incorrect, but the code is basically what IsDebuggerPresent does.
Get a pointer to the TEB (located at fs:18h)
Get a pointer to the PEB (located at teb+30h)
Check the BeingDebugged flag (located at peb+2)
The syntax should be something like:
mov eax, large fs:18h
mov eax, [eax+30h]
movzx eax, byte ptr [eax+2]
If you don't ...
7
So how exactly do i figure out what is the remote process it is going
to communicate with, or what pipe it is using to communicate?
The first step is to find the RPC client interface. This can be found via the first argument to NdrClientCall2(), named pStubDescriptor. In your question, pStubDescriptor points to SspiCli!sspirpc_StubDesc:
And here is how ...
7
When a debugger wants to attach to a process it will do the following things (see the DebugActiveProcess implementation on ReactOS):
Connect to the debuggee with DbgUiConnectToDbg
Tell the kernel to start debugging the process with NtDebugActiveProcess
Issue a DbgBreakPoint in the attached-to process with DbgUiIssueRemoteBreakin
The DbgUiIssueRemoteBreakin ...
6
In general, this concept is referred to as register preservation or register volatility.
From http://en.wikipedia.org/wiki/X86_calling_conventions#Register_preservation --
According to the Intel ABI to which the vast majority of compilers
conform, the EAX, EDX, and ECX are to be free for use within a
procedure or function, and need not be preserved.
...
6
You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you want a 64 bit process, replace every x86 with x64):
Extract ScyllaHide (download) anywhere;
Run NtApiTool\x86\PDBReaderx86.exe and when it's finished, copy ...
6
Call NtSuspendProcess() on the child process.
Inject code into the parent process to call DebugActiveProcessStop() on the child process.
Attach your debugger to the child process.
Call NtResumeProcess() on the child process.
6
That's where strace comes in handy. If i make your program compilable and compile it:
$cat trap.c
#include <signal.h>
void sigtrap_func(int sig) { puts("trap"); }
int main()
{
signal(SIGTRAP, sigtrap_func);
}
$ cc -o trap trap.c
and then run it with strace, i'll get a list of all system calls the program executes:
$strace -i ./trap
[ ...
6
Here are a few links that address your question in a broad manner:
VMAttack: Deobfuscating Virtualization-Based Packed Binaries
Link to PDF Paper which uses the VMAttack IDA PRO Plugin.
Unpacking Virtualization Obfuscators by Rolf Rolles.
Unpacking the FinSpy VM, parts #1, #2, #3
Various other articles by Rolf Rolles .
5
It is possible the ways the other commenters suggested. However, all of them are interceptable, if you read a file, it can be intercepted and your program will be given different result, if you check if LD_PRELOAD is set, it can be unset before you can reach out to it, etc. Suid is another story, though, but there may be different ways of exploiting it too.
5
The code is expecting an exception to occur, which will happen in the absence of a debugger. If a debugger is present, the breakpoint exception will usually be suppressed by the debugger, and execution will continue at either 0x455067 or 0x455068, depending on the debugger.
You have two simple choices: one choice is that you could just let execution reach ...
5
Check the context argument to NtContinue (first arg). NtContinue works as an anti-debug by potentially clearing DR7 or breaking out of single stepping by clearing the trap flag, then returning to the IP specified in the context, after applying the register state.
5
Use dbg.forks=true to stop the debugger when a fork happens. and then just use dp to list and select the pid you want to follow.
5
I work in AV industry for about a year now and I can tell you how I see this. How fast can you get rid of certain anti-reversing techniques depends on your experience and will to learn and understand as many of those techniques as possible.
I mostly work with PE packers and at the beginning I had problems with removing the most simple techniques like ...
5
You can use something like Scylla Hide
https://github.com/nihilus/ScyllaHide
It has plugins for most popular debuggers. It has lots of hiding options and presets for advanced packers like Themida.
You can also try Titan Hide.
https://github.com/mrexodia/TitanHide
5
TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program.
A more detailed explanation
Here you can see the documentation for setunhandledexceptionfilter, reading it if you didn't already might make things clearer for you.
To make sure that ...
5
The error you've received was probably thrown by either Themida or WinLicense, a well known protectors. I'd say here that fully bypass of both Themida and WinLicense are goals that are hard to reach for an inexperienced reverse engineer.
Because it's the 3rd question you ask about this subject, and it seems like you are truly struggle with it, I'll show ...
4
What is the target program? Is it known to have an antihack? (If so, who makes it?) Are you on a 32-bit or 64-bit OS?
Use GMER/EnumDeviceDrivers()/etc and check for drivers that "antihack.dll" might be loading. If there is a driver, load its binary into IDA and start reversing, and if you're on 32-bit grab an anti-rootkit program (GMER, kernel detective, ...
4
Also, try Detect It Easy. The project is alive and updated frequently.
4
There are CPU instructions and OS APIs that can achieve this, such as
RDPMC
RDTSC
GetLocalTime
GetSystemTime
GetTickCount
KiGetTickCount
QueryPerformanceCounter
timeGetTime
The result is achieved by requesting the current time, performing some kind of CPU-intensive operation (or requiring that someone debugging the code does so, such as single-stepping), ...
Only top voted, non community-wiki answers of a minimum length are eligible