#1
|
|||
|
|||
Another way to detect OllyDbg and another debugger
Hi all !
When I trying UnhandledExceptionFilter of xDREAM, I have detected a method which Windows uses to detect a app is being debugged (I dont know once else already have found it). The plugin of xDREAM patch the result of the call of NtQueryInformationProcess. Windows call NtQueryInformationProcess with ProcessInformationClass is 7 (DebugPort) to detect a app is being debugged. For example: open a exe with Visual studio or OllyDbg, open TaskManager, and kill the debugged exe, Windows will warning: "Program being debugged" or "Access denied". Search in my copy of Win2k source code, at the ntos folder, the function _EndTask of TaskManager uses this way. I wrote a small C program, compiled with VS .NET 2003, and test the exe with OllyDbg, VS, VS .NET, IDAPro debugger, WinDbg and TD32. The app will detect it is debugged. But with SoftIce, the app could not detect. But I can not use NtSetInformationProcess to clear the debug port value because it can only be set when debug port is zero. Hope I will receive your idea ! Regards, TQN |
#2
|
|||
|
|||
here
I think this method was discussed a while back on woodman
http://www.woodmann.net/forum/showthread.php?t=5420&highlight=NtQueryInformationProcess |
#3
|
|||
|
|||
Which references a thread here:
http://www.exetools.com/forum/showthread.php?s=&threadid=3164 and around and around we go. Regards,
__________________
JMI |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Using RtlAdjustPrivilege to detect debugger. | Insid3Code | Source Code | 2 | 03-05-2015 13:35 |
Unseen Debugger Detection (Ollydbg) | Peter[Pan] | General Discussion | 27 | 10-17-2005 09:34 |