Exetools - Using RtlAdjustPrivilege to detect debugger.

Exetools (https://forum.exetools.com/index.php)

- Source Code (https://forum.exetools.com/forumdisplay.php?f=46)

- - Using RtlAdjustPrivilege to detect debugger. (https://forum.exetools.com/showthread.php?t=16592)

Using RtlAdjustPrivilege to detect debugger.

A basic way using RtlAdjustPrivilege to detect the debugger (OllyDbg and IDA demo 6.6)

As usually but not (enabled by default) for all debugger, the Debugger must acquiring debug privilege to work with its complete capacity.
The snippet is simple and probably already used but I write it as simple as possible to get a clear ASM code inside the debugger.

RtlAdjustPrivilege: Enables or disables a privilege from the calling thread or process.

PHP Code:


		
			
NTSTATUS RtlAdjustPrivilege

 (

  ULONG    Privilege,     //[In]    Privilege index to change.

  BOOLEAN  Enable,        //[In]    If TRUE, then enable the privilege otherwise disable.

  BOOLEAN  CurrentThread, //[In]    If TRUE, then enable in calling thread, otherwise process.

  PBOOLEAN Enabled        //[Out]    Whether privilege was previously enabled or disabled.

 )

RtlAdjustPrivilege store the previous status into boolean variable.

Our work is to read the contents of this variable after calling RtlAdjustPrivilege with SE_DEBUG_PRIVILEGE as parameter, and of course if a status is already enabled then we have a likely debugging situation.

PHP Code:


		
			
/*

 * -------------------------------------------------

 * Using RtlAdjustPrivilege to detect debugger.

 * Tested on (OllyDbg and IDA demo 6.6)

 * Released 03/2015.

 * [by Insid3Code from I3CT]

 * -------------------------------------------------

*/



#include <windows.h>

#include <ntdll.h>



#ifdef _WIN64

#define captionMsg L"Application 64-bit"

#else

#define captionMsg L"Application 32-bit"

#endif



int WINAPI iWinMain() {

    //Boolean to check after calling RtlAdjustPrivilege.

    BOOLEAN bPreviousPrivilegeStatus; 



    RtlAdjustPrivilege(

        SE_DEBUG_PRIVILEGE,

        FALSE, // avoid to adjust privilege (DISABLE IT).

        FALSE,

        &bPreviousPrivilegeStatus);



// check if SE_DEBUG_PRIVILEGE was already acquired then voluntary crash the application,

// by calling memset with invalid pointer as parameter.        

    if (bPreviousPrivilegeStatus) 

        memset(NULL, 0, 1); //<-- BOOM! PADA BOOM!!!



    MessageBoxW(

        NULL,

        L"Nothing!",

        captionMsg,

        MB_ICONINFORMATION);



    return 0;

}

Attached: Source, screenshots and binary (32bit/64bit)

Detection by opening csrss process is based on the similar principle. It can be fixed by running a debuggee with a privilege-stripped token.

It seems (Tuts4You Forum) that the desired result is uncontrollable, and some conditions which must be fulfilled, such Run as administrator (UAC) and debug privilege which must already acquired by the Debugger...

As mentioned by Archer there are similarity with detecting the debugger by trying to open "csrss.exe" process with PROCESS_ALL_ACCESS as parameter (debug privilege needed) also limited by the same conditions mentioned above.

PHP Code:


		
			
#include <windows.h>

#include <ntdll.h>



#ifdef _WIN64

#define captionMsg L"64-bit Application"

#else

#define captionMsg L"32-bit Application"

#endif



int WINAPI iWinMain() {



    HANDLE ProcessHandle = NULL;

    OBJECT_ATTRIBUTES ObjectAttributes;

    CLIENT_ID ClientId;



    ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);

    ObjectAttributes.RootDirectory = 0;

    ObjectAttributes.ObjectName = NULL;

    ObjectAttributes.Attributes = OBJ_CASE_INSENSITIVE;

    ObjectAttributes.SecurityDescriptor = NULL;

    ObjectAttributes.SecurityQualityOfService = NULL;



    ClientId.UniqueProcess = CsrGetProcessId(); // getting "csrss.exe" ProcessId.

    ClientId.UniqueThread = 0;



    NtOpenProcess(

        &ProcessHandle,

        PROCESS_ALL_ACCESS, // This parameter need SeDebugPrivilege.

        &ObjectAttributes,

        &ClientId);



    if (ProcessHandle != NULL)

        memset(NULL, 0, 1); //<-- BOOM! PADA BOOM!!!



    MessageBoxW(

        NULL,

        L"Nothing!",

        captionMsg,

        MB_ICONINFORMATION);

    return 0;

}

Then to complete this topic (Debug Privilege), attached second sample based on "csrss.exe" process handling.

Regards