当前位置:网站首页>De debugging (set the main thread as hidden debugging to destroy the debugging Channel & debugger detection)
De debugging (set the main thread as hidden debugging to destroy the debugging Channel & debugger detection)
2022-07-05 03:33:00 【#A#】
Debugging is essentially the next int3( abnormal ), There's an exception , The debugger will receive an exception , Will give the opportunity to deal with , Find the debugger before processing , Find the debugger after processing , Find the debugger twice . Using the functions of the driver layer can hide the thread settings under debugging , The original meaning is that the process does not debug , But the consequence is when the thread itself is attached with a debugger , Originally, one int3 The breakpoint of , What happens is an exception , There will be exceptions here , The debugger doesn't handle
Because it is an undisclosed function , You need to load the export table first
void GameProtect::AntiDebug()
{
auto hNtdll = LoadLibrary(L"ntdll.dll");
if (hNtdll)
{
ZwSetInfomationThreadPtr ZwSetInfomationThread;
ZwSetInfomationThread = (ZwSetInfomationThreadPtr)GetProcAddress(hNtdll, "ZwSetInformationThread");
ZwSetInfomationThread((DWORD)GetCurrentThread(), 0x11, 0x0, 0x0);
}
}
test : next int3 Breakpoint direct GG
Because the next one int3 Breakpoints essentially produce an exception , Exception find the debugger and find that the debugger does not respond , Go back to the program to deal with , The program cannot handle , Find the debugger , The debugger crashes when it ignores it
Use these functions to be obscene , Otherwise, when reverse analysis, look at the string table directly GG, It's better to use the login to send the address directly
Debugger detection :
adopt BeingDebugged testing :
// testing PEB structure
BOOL debug = IsDebuggerPresent();
BOOL _debug;
CheckRemoteDebuggerPresent(GetCurrentProcess(), &_debug);
if (debug)AfxMessageBox(L"IsDebuggerPresent Debugger detected ");
if (_debug)AfxMessageBox(L"CheckRemoteDebuggerPresent Debugger detected ");
Compile operation use x32DBG additional :
It was detected .
General debugger such as OD Will dispose of this place It has plug-ins that can fix this place , In essence, it's going to be beingdebug Field processed
commonly BeingDebugged The detection of is of little use The assembly code is directly changed 0 perhaps HOOK This function can also pass
OD Plug in for :
Detect the debugger through kernel properties :
In principle application layer Access to kernel mode is not available , But Microsoft still left a hole .
utilize NtQueryInformationProcess pick up information :
NTSTATUS(NTAPI* NtQueryInformationProcess)(
HANDLE ProcessHandle,// Process handle
DWORD ProcessInformationClass,// Information types
PVOID ProcessInformation,// Information pointer
ULONG ProcessInformationLength,// Information pointer size
PULONG ReturnLength // Write buffer size
)
PROCESSINFOCLASS 0x7 DebugPort
PROCESSINFOCLASS 0x1E DebugObjectHandle
PROCESSINFOCLASS 0x1F DebugFlags
The third parameter is an enumeration type But with DWORD Also yes
BOOL GameProtect::CheckDebugByNT()
{
//
DWORD debug_port = 0;
NtQueryInfomationProcess(HProcess, 0x07, &debug_port, sizeof(debug_port), 0x0);
if (debug_port)return TRUE;
HANDLE debug_object = 0;
// testing DBGOBJECT
NtQueryInfomationProcess(HProcess, 0x1E, &debug_object, sizeof(debug_object), 0x0);
if (debug_object)return TRUE;
BOOL debug_flags = 1;
NtQueryInfomationProcess(HProcess, 0x1F, &debug_flags, sizeof(debug_flags), 0x0);
if (!debug_flags)return TRUE;
return FALSE;
}
边栏推荐
- Linux Installation redis
- Monitoring web performance with performance
- 1.五层网络模型
- 2021 Li Hongyi machine learning (2): pytorch
- Machine learning experiment report 1 - linear model, decision tree, neural network part
- Kubernetes -- cluster expansion principle
- 有個疑問 flink sql cdc 的話可以設置並行度麼, 並行度大於1會有順序問題吧?
- The perfect car for successful people: BMW X7! Superior performance, excellent comfort and safety
- Azkaban actual combat
- IPv6 experiment
猜你喜欢
Acwing第 58 场周赛【完结】
Sqoop安装
Talk about the SQL server version of DTM sub transaction barrier function
SQL performance optimization skills
Pat class a 1160 forever (class B 1104 forever)
Bumblebee: build, deliver, and run ebpf programs smoothly like silk
Huawei MPLS experiment
[安洵杯 2019]不是文件上传
qrcode:将文本生成二维码
[luat-air105] 4.1 file system FS
随机推荐
Asemi rectifier bridge 2w10 parameters, 2w10 specifications, 2w10 characteristics
Bumblebee: build, deliver, and run ebpf programs smoothly like silk
Use of kubesphere configuration set (configmap)
Asp+access campus network goods trading platform
Binary heap implementation (priority queue implementation)
Dart series: collection of best practices
Master Fur
Devtools的簡單使用
[2022 repair version] community scanning code into group activity code to drain the complete operation source code / connect the contract free payment interface / promote the normal binding of subordi
MySQL winter vacation self-study 2022 11 (10)
When sqlacodegen generates a model, how to solve the problem that the password contains special characters?
Easy processing of ten-year futures and stock market data -- Application of tdengine in Tongxinyuan fund
New interesting test applet source code_ Test available
2021 Li Hongyi machine learning (3): what if neural network training fails
Difference between MotionEvent. getRawX and MotionEvent. getX
This + closure + scope interview question
Kubernetes - Multi cluster management
Performance of calling delegates vs methods
Basic authorization command for Curl
2.常见的请求方法