当前位置:网站首页>De debugging (set the main thread as hidden debugging to destroy the debugging Channel & debugger detection)
De debugging (set the main thread as hidden debugging to destroy the debugging Channel & debugger detection)
2022-07-05 03:33:00 【#A#】
Debugging is essentially the next int3( abnormal ), There's an exception , The debugger will receive an exception , Will give the opportunity to deal with , Find the debugger before processing , Find the debugger after processing , Find the debugger twice . Using the functions of the driver layer can hide the thread settings under debugging , The original meaning is that the process does not debug , But the consequence is when the thread itself is attached with a debugger , Originally, one int3 The breakpoint of , What happens is an exception , There will be exceptions here , The debugger doesn't handle
Because it is an undisclosed function , You need to load the export table first
void GameProtect::AntiDebug()
{
auto hNtdll = LoadLibrary(L"ntdll.dll");
if (hNtdll)
{
ZwSetInfomationThreadPtr ZwSetInfomationThread;
ZwSetInfomationThread = (ZwSetInfomationThreadPtr)GetProcAddress(hNtdll, "ZwSetInformationThread");
ZwSetInfomationThread((DWORD)GetCurrentThread(), 0x11, 0x0, 0x0);
}
}
test : next int3 Breakpoint direct GG
Because the next one int3 Breakpoints essentially produce an exception , Exception find the debugger and find that the debugger does not respond , Go back to the program to deal with , The program cannot handle , Find the debugger , The debugger crashes when it ignores it
Use these functions to be obscene , Otherwise, when reverse analysis, look at the string table directly GG, It's better to use the login to send the address directly
Debugger detection :
adopt BeingDebugged testing :
// testing PEB structure
BOOL debug = IsDebuggerPresent();
BOOL _debug;
CheckRemoteDebuggerPresent(GetCurrentProcess(), &_debug);
if (debug)AfxMessageBox(L"IsDebuggerPresent Debugger detected ");
if (_debug)AfxMessageBox(L"CheckRemoteDebuggerPresent Debugger detected ");
Compile operation use x32DBG additional :
It was detected .
General debugger such as OD Will dispose of this place It has plug-ins that can fix this place , In essence, it's going to be beingdebug Field processed
commonly BeingDebugged The detection of is of little use The assembly code is directly changed 0 perhaps HOOK This function can also pass
OD Plug in for :
Detect the debugger through kernel properties :
In principle application layer Access to kernel mode is not available , But Microsoft still left a hole .
utilize NtQueryInformationProcess pick up information :
NTSTATUS(NTAPI* NtQueryInformationProcess)(
HANDLE ProcessHandle,// Process handle
DWORD ProcessInformationClass,// Information types
PVOID ProcessInformation,// Information pointer
ULONG ProcessInformationLength,// Information pointer size
PULONG ReturnLength // Write buffer size
)
PROCESSINFOCLASS 0x7 DebugPort
PROCESSINFOCLASS 0x1E DebugObjectHandle
PROCESSINFOCLASS 0x1F DebugFlags
The third parameter is an enumeration type But with DWORD Also yes
BOOL GameProtect::CheckDebugByNT()
{
//
DWORD debug_port = 0;
NtQueryInfomationProcess(HProcess, 0x07, &debug_port, sizeof(debug_port), 0x0);
if (debug_port)return TRUE;
HANDLE debug_object = 0;
// testing DBGOBJECT
NtQueryInfomationProcess(HProcess, 0x1E, &debug_object, sizeof(debug_object), 0x0);
if (debug_object)return TRUE;
BOOL debug_flags = 1;
NtQueryInfomationProcess(HProcess, 0x1F, &debug_flags, sizeof(debug_flags), 0x0);
if (!debug_flags)return TRUE;
return FALSE;
}
边栏推荐
- Flex flexible layout
- Six stone programming: advantages of automated testing
- Yyds dry goods inventory intelligent fan based on CC2530 design
- Voice chip wt2003h4 B008 single chip to realize the quick design of intelligent doorbell scheme
- [luat-air105] 4.1 file system FS
- Apache Web page security optimization
- Blue Bridge Cup single chip microcomputer -- PWM pulse width modulation
- Basic authorization command for Curl
- How can we truncate the float64 type to a specific precision- How can we truncate float64 type to a particular precision?
- The latest blind box mall, which has been repaired very popular these days, has complete open source operation source code
猜你喜欢
Azkaban概述
Azkaban overview
Watch the online press conference of tdengine community heroes and listen to TD hero talk about the legend of developers
Mongodb common commands
Flume配置4——自定义MYSQLSource
Blue Bridge Cup single chip microcomputer -- PWM pulse width modulation
The latest blind box mall, which has been repaired very popular these days, has complete open source operation source code
About MySQL database connection exceptions
Huawei MPLS experiment
Bumblebee: build, deliver, and run ebpf programs smoothly like silk
随机推荐
[groovy] string (string injection function | asBoolean | execute | minus)
Kubernetes - Multi cluster management
qrcode:将文本生成二维码
There is a question about whether the parallelism can be set for Flink SQL CDC. If the parallelism is greater than 1, will there be a sequence problem?
端口,域名,协议。
[105] Baidu brain map - Online mind mapping tool
Basic authorization command for Curl
Apache build web host
Leetcode92. reverse linked list II
为什么腾讯阿里等互联网大厂诞生的好产品越来越少?
VM in-depth learning (XXV) -class file overview
Pytest (4) - test case execution sequence
51 independent key basic experiment
The latest blind box mall, which has been repaired very popular these days, has complete open source operation source code
Acwing game 58 [End]
v-if VS v-show 2.0
Cette ADB MySQL prend - elle en charge SQL Server?
Flume configuration 4 - customize mysqlsource
Is there any way to change the height of the uinavigationbar in the storyboard without using the UINavigationController?
Vb+access hotel service management system