beating IsDebuggerPresent for my unpacker
hi, could anybody explain me how to defeat IsDebuggerPresent?
i downloaded some sources of olly plugins but i dont understand what they are actually doing. source code would be nice. |
Looking for this...?
Code Taken From: Guide on How to play with processes memory, write loaders and Oraculums
http://www.exetools.com/forum/showthread.php?t=6556 Many Thanks to Shub-Nigurrath Code:
unsigned long KillisDebuggerPresent() |
I was not read the tutor of Shub-Nigurrath yet, but with the above code, I have a wonder: this function will be called from: the loader or the victim process.
|
IsDebuggerPresent is the most weak anti-debug check.
If you want to defeat it then I would propose the following: - modification of kernel32.dll (overwriting during the runtime) - hooking the API itself (if the protection is more sophisticated and computes the checksum of it then usually it checks only first few instructions, you should be still able to set the hook at one of the last instructions inside this API) - modification of IsDebuggerPresent return value in the code space of protected software (e.g. set a hardware breakpoint near the call offset) Regards. |
Quote:
However with little to no modification this code or its equivalent could be used in combination with y0da's Force Library and thus IsDebuggerPresnt could be defeated via RemoteExec which enables you to execute code within the context of another process Regards... |
absolutely correct, there are plenty ways to inject code into another one, directly in memory..
see the well known paper, just to start on this argument.. http://www.codeguru.com/Cpp/W-P/system/processesmodules/article.php/c5767 |
another way, doesnt hook anything....
Code:
bool DisableBeingDebuggedFlag(HANDLE thread) btw.... Shub-Nigurrath, is this needed for speed optimization or what ?:PPP Quote:
|
Looks nice (logic). Anyway, won't work on 9x family.
Now, all hardcore maniacs, tell me why? :) Regards. |
give me a kernel32.dll from 9x and i'll answer you hehe ;)
(i dont have any laying around here and dont have any docs about win9x TIB, PEB(?!?) either). |
Hey, that would be too easy ;)
You are accessing segment register to obtain the address of PEB and read process data. Since TEB (or TIB if you like) and PEB are well settled on WinNT clones but not on Win9x family, you have to be familiar with Win9x/WinNT kernels. TEB is not a problem here because its field is the same on all Windows. The problematic topic in your example is PEB. By using two additional APIs you will be able to add Win9x compatibility to the method you presented. I made my homework. Who's next (to tell us which APIs I'm talking about or/and present another solution)? Regards. |
upb you want 9x IsDebuggerPresent raw code in kernel32.dll ??
her it is if you wanted that Code:
BFF946F6 IsDebuggerPresent A1 E49CFCBF MOV EAX,DWORD PTR DS:[BFFC9CE4] Code:
DS:[BFFC9CE4]=C00309C8 Code:
DS:[C00309C8]=81752074 Code:
817520B4 3C 21 75 81 B0 A0 5F C1 80 0B 75 81 80 26 75 81 <!u° _Á€u€&u flag position on compare Code:
EAX C00309C8 Code:
EAX C00309C8 on return Return to 00401005 (OLLYDBG.00401005) Code:
registers and flag on return now ollydbg cant see the address 0xc00309c8 |
well damn...
i started reading the MSJ may 1996 article and found another thing that can be used to check for a debugger in win9x:
Quote:
Dno, after researching for 30 mins, i dont have enough motivation to add support for this ancient architecture :P anyone who does, read this article: hxxp://www.microsoft.com/msj/archive/S2CE.aspx Quote:
|
well what you posted about fs:[20] was documented some where in wasm.ru
when i searched here is a snippet from there i had saved Code:
mov ecx,fs:[20h] the article is here http://wasm.ru/article.php?article=1017001 also there was some mention of fs:[60] in a japanese page ¡ºOllyDbg¡»¤¬±íʾ¤¹¤ë¡¸×îáá¤Î¥¨¥é©`¡¹¤Î¥¨¥é©`¥³©`¥É¤Ï¡¸FS:[34]¡¹(Win2k/XP)¤Þ¤¿¤Ï¡¸FS:[60]¡¹(Win9x/Me)¤Î‚Ž¤Ç¤¹¡£¤¿¤À¤·¡¢¤³¤Î¥¨¥é©`¥³©`¥É¤Î‚Ž¤¬GetLastErrorévÊý¤Î‘ø¤ê‚Ž¤ÈÒ»Ö¤·¤Ê¤¤¥±©`¥¹¤â¤¢¤ê¤Þ¤¹¡£ÌؤËWindows2000/XP¤Ç¤Î¤ßGetLastErrorévÊý¤Ç¥¨¥é©`¥³©`¥É¤òÈ¡µÃ¿ÉÄܤÊAPIévÊý¤Ë×¢ some more storage of info here is an url to the code i pasted if some one want to test it in 9x http://www.powerbasic.com/support/forums/Forum6/HTML/004517.html Code:
Function IsDebuggerAttached() as Long |
Quote:
Quote:
"Thread Information Block (TIB)" with it is the local housing territory of the thread which is called. As for the first address of this data block making use of the segmented register, "FS: [ 18 ] "With it can acquire. Furthermore, with NT system OS originally this data block is called "Thread Environment Block (TEB)" with, but both between the reverse engineer is called TIB. ' OllyDbg ' it indicates as for "the error cord/code of" last error "FS: [ 34 ] "(Win2k/XP) or" FS: [ 60 ] "(Win9x/Me) it is value. However, there is also a case where value of this error cord/code does not match the return value of GetLastError function. With only especially Windows2000/XP the error cord/code please pay attention to acquisition possible API function with GetLastError function. Furthermore, don't you think? ' special frame is ¤Þ 57 ' the function which converts the error cord/code to the Japanese descriptive text is mounted, (inside "the application control" window). By the way, with the main thread of ¥Ç¥Ð¥Ã¥®©` "FS: [ 04 ] "With" FS: [ 08 ] "The stacked area it is possible also from value to specify. |
Code:
; debug api test while BeingDebugged you can (upb's 1st post) debug api in 9x suck for example try to trace (single step) not esp not esp *crash* forget about 9x, support only NT (it's only a unpacker, unpacked exe must work on both) |
All times are GMT +8. The time now is 17:14. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX