18 votes
Accepted

How to investigate Windows 32/64bit (WOW64) transition

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
user avatar
  • 11.4k
10 votes
Accepted

Bypass IsDebuggerPresent

Let's have a look of the function's description in MSDN: Determines whether the calling process is being debugged by a user-mode debugger As you guessed, this function is commonly used as an ...
user avatar
  • 8,649
9 votes
Accepted

at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?

So how exactly do i figure out what is the remote process it is going to communicate with, or what pipe it is using to communicate? The first step is to find the RPC client interface. This can be ...
user avatar
9 votes

How to bypass ZwContinue?

ntdll!ZwContinue takes the same parameters than ntdll!NtContinue, that is the following : NTSTATUS NTAPI NtContinue ( IN PCONTEXT ThreadContext, IN BOOLEAN RaiseAlert ); You can read the "Eip" ...
user avatar
  • 578
9 votes
Accepted

Detecting hardware breakpoints

This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that ...
user avatar
  • 8,649
9 votes

VMProtect anti-debug method

VMProtect uses a few anti-debug techniques. Firstly, you aren't going to want to tackle them on your own because there is quite and exhaustive set of techniques to detect a debugger. Consider using an ...
user avatar
  • 253
9 votes

Why does PE ImageBase address change in memory?

This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location. ImageBase: The preferred address of the first byte of image when loaded into ...
user avatar
8 votes
Accepted

How does this test for debugger

The syntax is incorrect, but the code is basically what IsDebuggerPresent does. Get a pointer to the TEB (located at fs:18h) Get a pointer to the PEB (located at teb+30h) Check the BeingDebugged flag ...
user avatar
  • 1,561
7 votes
Accepted

Thread EntryPoint in TLS callback as AntiDebug technique

When a debugger wants to attach to a process it will do the following things (see the DebugActiveProcess implementation on ReactOS): Connect to the debuggee with DbgUiConnectToDbg Tell the kernel to ...
user avatar
  • 1,602
6 votes
Accepted

Find sigtrap function

That's where strace comes in handy. If i make your program compilable and compile it: $cat trap.c #include <signal.h> void sigtrap_func(int sig) { puts("trap"); } int main() { signal(SIGTRAP,...
user avatar
6 votes

Debugger hiding plugin for WinDbg?

You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you ...
user avatar
  • 1,602
6 votes

How to bypass ZwContinue?

Check the context argument to NtContinue (first arg). NtContinue works as an anti-debug by potentially clearing DR7 or breaking out of single stepping by clearing the trap flag, then returning to the ...
user avatar
  • 261
6 votes
Accepted

Finding OEP in a VMProtect v3.0 protected malware

Here are a few links that address your question in a broad manner: VMAttack: Deobfuscating Virtualization-Based Packed Binaries Link to PDF Paper which uses the VMAttack IDA PRO Plugin. Unpacking ...
user avatar
  • 136
5 votes
Accepted

Handling INT 2D anti-debugger technique in IDA Pro

The code is expecting an exception to occur, which will happen in the absence of a debugger. If a debugger is present, the breakpoint exception will usually be suppressed by the debugger, and ...
user avatar
  • 4,511
5 votes

Detecting tracing in Linux

It is possible the ways the other commenters suggested. However, all of them are interceptable, if you read a file, it can be intercepted and your program will be given different result, if you check ...
user avatar
5 votes

Debugging forked child in an anti-debug protected crackme

Use dbg.forks=true to stop the debugger when a fork happens. and then just use dp to list and select the pid you want to follow.
user avatar
  • 377
5 votes

What is the average time for "defusing" malware self-protection mechanisms?

I work in AV industry for about a year now and I can tell you how I see this. How fast can you get rid of certain anti-reversing techniques depends on your experience and will to learn and understand ...
user avatar
  • 1,043
5 votes
Accepted

Getting past a whole lot of anti-debug measures for a windows exe

You can use something like Scylla Hide https://github.com/nihilus/ScyllaHide It has plugins for most popular debuggers. It has lots of hiding options and presets for advanced packers like Themida. ...
user avatar
5 votes

how to overcome setunhandledexceptionfilter in ollyDebugger?

TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program. A more detailed ...
user avatar
  • 11.4k
5 votes

Working backwards from a popup

The error you've received was probably thrown by either Themida or WinLicense, a well known protectors. I'd say here that fully bypass of both Themida and WinLicense are goals that are hard to reach ...
user avatar
  • 8,649
5 votes

Jump in the middle trick

Yes, this is indeed possible to employ consistently throughout the entire assembly listing, making manual analysis or adjustments a pain. Disassemblers are often divided into two categories: linear ...
user avatar
  • 11.4k
4 votes

Defeat QueryPerformanceCounter as Anti-Debugging trick

..... CALL DWORD PTR DS:[109407C] kernel32.GetSystemTimeAsFileTime MOV ESI, DWORD PTR SS:[EBP-4] XOR ESI, DWORD PTR SS:[EBP-8] CALL DWORD PTR DS:[10940F4] kernel32.GetCurrentProcessId ...
user avatar
4 votes
Accepted

Detection of OllyDbg - INT3?

This technique uses the fact that when the interrupt instructions INT3 (breakpoint) and INT1 (single-step) are stepped thru inside a debugger, by default, the exception handler will not be invoked ...
user avatar
  • 314
4 votes

Self modifying codes

If I want to protect my binary from disassembling, does the second method has any disadvantage compared to the first one? The second method requires that you have access to the source code¹, ...
user avatar
4 votes
Accepted

Anti-Reverse Question on implementing a Shellcode

Writing a shellcode is often a task considerably more difficult than developing a piece of software. To me it seems your assumption about developing your program as a shellcode is incorrect and will ...
user avatar
  • 11.4k
4 votes
Accepted

What is __sighandler_t struct and purpose of SIGTRAP signal handler

First, am I right to think that the purpose of this is to create a handler for the SIGTRAP signal, probably in order to prevent any debuger use When a SIGTRAP is raised, normally the handler ...
user avatar
  • 1,074
3 votes
Accepted

Ollydbg and IDA Pro unable to attach to process

Debug the loader. Set a breakpoint on CreateProcess (or ZwCreateProcess if needed) When the breakpoint is hit modify the process creation flags on the stack to include CREATE_SUSPENDED. Make sure ...
user avatar
  • 5,860
3 votes

(linux) How to debug a "debugger"?

You can break on the ptrace, bypass it, set it return value as if it was succesfuly called, use two instances of GDB: one for the child, and one for the father.
user avatar
  • 2,486
3 votes

How to detect a virtualized environment?

Here is a collection of anti-sandbox/vm/debugger techniques implemented in a open source program which will give you a clear idea how to detect virtualization: https://github.com/LordNoteworthy/al-...
user avatar
3 votes

INT 2D Anti-Forensic Method

The interrupt 0x2D is a special case. When it is executed, Windows uses the current EIP register value as the exception address, and then it increments by one the EIP register value. However, ...
user avatar
  • 31

Only top scored, non community-wiki answers of a minimum length are eligible