I have recently come up with a new anti-debug trick, which can be useful only if the "Break on new thread" option is set in OllyDbg. The trick has been tried on OllyDbg v1.10 and Immunity Debugger v1.83 in Windows 7, Wow64. Actually, i am not sure if someone else has already found it.
In any affected debugger, if CREATE_THREAD_DEBUG_EVENT is received and the "Break on new thread" option is set, the debugger places an int3 software breakpoint on the lpStartAddress. There is a narrow time window between setting the int3 software breakpoint and recovering the original byte and this is what we are going to exploit.
N.B. The next few lines are only for demonstration. More complicated methods may evolve out of them.
Having two threads in an application, the first thread does almost nothing and the second one checks the first byte of the first thread's entrypoint, we can simply detect the debugger. See the image below.
The demo can be found here. You can also find its source code here.
An XP-compatible demo can be found here. You can find its source code here.
You can follow me on Twitter @waleedassar
In any affected debugger, if CREATE_THREAD_DEBUG_EVENT is received and the "Break on new thread" option is set, the debugger places an int3 software breakpoint on the lpStartAddress. There is a narrow time window between setting the int3 software breakpoint and recovering the original byte and this is what we are going to exploit.
N.B. The next few lines are only for demonstration. More complicated methods may evolve out of them.
Having two threads in an application, the first thread does almost nothing and the second one checks the first byte of the first thread's entrypoint, we can simply detect the debugger. See the image below.
The demo can be found here. You can also find its source code here.
An XP-compatible demo can be found here. You can find its source code here.
You can follow me on Twitter @waleedassar
No comments:
Post a Comment