当前位置:网站首页>De debugging (set the main thread as hidden debugging to destroy the debugging Channel & debugger detection)
De debugging (set the main thread as hidden debugging to destroy the debugging Channel & debugger detection)
2022-07-05 03:33:00 【#A#】
Debugging is essentially the next int3( abnormal ), There's an exception , The debugger will receive an exception , Will give the opportunity to deal with , Find the debugger before processing , Find the debugger after processing , Find the debugger twice . Using the functions of the driver layer can hide the thread settings under debugging , The original meaning is that the process does not debug , But the consequence is when the thread itself is attached with a debugger , Originally, one int3 The breakpoint of , What happens is an exception , There will be exceptions here , The debugger doesn't handle
Because it is an undisclosed function , You need to load the export table first
void GameProtect::AntiDebug()
{
auto hNtdll = LoadLibrary(L"ntdll.dll");
if (hNtdll)
{
ZwSetInfomationThreadPtr ZwSetInfomationThread;
ZwSetInfomationThread = (ZwSetInfomationThreadPtr)GetProcAddress(hNtdll, "ZwSetInformationThread");
ZwSetInfomationThread((DWORD)GetCurrentThread(), 0x11, 0x0, 0x0);
}
}
test : next int3 Breakpoint direct GG
Because the next one int3 Breakpoints essentially produce an exception , Exception find the debugger and find that the debugger does not respond , Go back to the program to deal with , The program cannot handle , Find the debugger , The debugger crashes when it ignores it
Use these functions to be obscene , Otherwise, when reverse analysis, look at the string table directly GG, It's better to use the login to send the address directly
Debugger detection :
adopt BeingDebugged testing :
// testing PEB structure
BOOL debug = IsDebuggerPresent();
BOOL _debug;
CheckRemoteDebuggerPresent(GetCurrentProcess(), &_debug);
if (debug)AfxMessageBox(L"IsDebuggerPresent Debugger detected ");
if (_debug)AfxMessageBox(L"CheckRemoteDebuggerPresent Debugger detected ");
Compile operation use x32DBG additional :
It was detected .
General debugger such as OD Will dispose of this place It has plug-ins that can fix this place , In essence, it's going to be beingdebug Field processed
commonly BeingDebugged The detection of is of little use The assembly code is directly changed 0 perhaps HOOK This function can also pass
OD Plug in for :
Detect the debugger through kernel properties :
In principle application layer Access to kernel mode is not available , But Microsoft still left a hole .
utilize NtQueryInformationProcess pick up information :
NTSTATUS(NTAPI* NtQueryInformationProcess)(
HANDLE ProcessHandle,// Process handle
DWORD ProcessInformationClass,// Information types
PVOID ProcessInformation,// Information pointer
ULONG ProcessInformationLength,// Information pointer size
PULONG ReturnLength // Write buffer size
)
PROCESSINFOCLASS 0x7 DebugPort
PROCESSINFOCLASS 0x1E DebugObjectHandle
PROCESSINFOCLASS 0x1F DebugFlags
The third parameter is an enumeration type But with DWORD Also yes
BOOL GameProtect::CheckDebugByNT()
{
//
DWORD debug_port = 0;
NtQueryInfomationProcess(HProcess, 0x07, &debug_port, sizeof(debug_port), 0x0);
if (debug_port)return TRUE;
HANDLE debug_object = 0;
// testing DBGOBJECT
NtQueryInfomationProcess(HProcess, 0x1E, &debug_object, sizeof(debug_object), 0x0);
if (debug_object)return TRUE;
BOOL debug_flags = 1;
NtQueryInfomationProcess(HProcess, 0x1F, &debug_flags, sizeof(debug_flags), 0x0);
if (!debug_flags)return TRUE;
return FALSE;
}
边栏推荐
- Use of kubesphere configuration set (configmap)
- 2021 Li Hongyi machine learning (2): pytorch
- PHP cli getting input from user and then dumping into variable possible?
- Ask, does this ADB MySQL support sqlserver?
- Difference between MotionEvent. getRawX and MotionEvent. getX
- Kbp206-asemi rectifier bridge kbp206
- Performance of calling delegates vs methods
- Mongodb common commands
- [learning notes] month end operation -gr/ir reorganization
- Utilisation simple de devtools
猜你喜欢
2. Common request methods
线程基础知识
Pat grade a 1119 pre- and post order traversals (30 points)
The perfect car for successful people: BMW X7! Superior performance, excellent comfort and safety
[2022 repair version] community scanning code into group activity code to drain the complete operation source code / connect the contract free payment interface / promote the normal binding of subordi
qrcode:将文本生成二维码
Basic knowledge of tuples
The perfect car for successful people: BMW X7! Superior performance, excellent comfort and safety
New interesting test applet source code_ Test available
Pat class a 1162 postfix expression
随机推荐
[安洵杯 2019]不是文件上传
Azkaban安装部署
The latest blind box mall, which has been repaired very popular these days, has complete open source operation source code
SPI and IIC communication protocol
有个疑问 flink sql cdc 的话可以设置并行度么, 并行度大于1会有顺序问题吧?
this+闭包+作用域 面试题
英语必备词汇3400
El select, El option drop-down selection box
Linux Installation redis
Hot knowledge of multithreading (I): introduction to ThreadLocal and underlying principles
[system security] ten thousand words summary system virtualization container bottom layer principle experiment
Eight days of learning C language - while loop (embedded) (single chip microcomputer)
Leetcode42. connect rainwater
Apache build web host
Use of kubesphere configuration set (configmap)
Basic knowledge of tuples
Flume配置4——自定义MYSQLSource
Breaking the information cocoon - my method of actively obtaining information - 3
How to make OS X read bash_ Profile instead of Profile file - how to make OS X to read bash_ profile not . profile file
Master Fur