Anti Debugging

Anti debugging techniques written in C++.

• Anti Attach, Anti Anti Attach : AntiAttach.cpp, AntiAntiAttaching.cpp
• Text Section Hashing : TextSectionHasher.cpp
• VEH Checker, DR Register Resetter : VEH_Checker.cpp, DR_Register_Resetter.cpp

Anti Attach, Anti Anti Attach

Debugger attach process with DebugActiveProcess api.

DebugActiveProcess(pid);
DEBUG_EVENT dbgEvent;
BOOL dbgContinue = True;
while (dbgContinue) {
if (FALSE == WaitForDebugEvent(&dbgEvent, 100)) {
continue;
}
...
}

It creates a thread in debuggee, then it calls DbgUiRemoteBreakin() to debug process.

//AntiAttach__declspec(naked) void AntiAttach() {
__asm {
jmp ExitProcess
}
}
//mainHANDLE hProcess = GetCurrentProcess();
HMODULE hMod = GetModuleHandleW(L"ntdll.dll");
FARPROC func_DbgUiRemoteBreakin = GetProcAddress(hMod, "DbgUiRemoteBreakin");
WriteProcessMemory(hProcess, func_DbgUiRemoteBreakin, AntiAttach, 6, NULL);

Anti-Attacher hooks DbgUiRemoteBreakin and redirects it to ExitProcess. AntiAnti-Attacher releases the hooked function.

Text Section Hashing

Debugger sets a software breakpoint by overwriting the int 3 instruction.

It hashes text section and periodically checks that the text section has been changed.

while (1) {
Sleep(1000);
DWORD64 dwCurrentHash = HashSection(lpVirtualAddress, dwSizeOfRawData);
if (dwRealHash != dwCurrentHash) {
MessageBoxW(NULL, L"DebugAttached", L"WARN", MB_OK);
exit(1);
}
if (bTerminateThread) {
return;
}
}

VEH Checker, DR Register Resetter

VEH Debugger use Vectored Exception Handler.

It checks the fourth bit(ProcessUsingVEH) of the PEB's CrossProcessFlags(+0x50). If ProcessUsingVEH bit is set, then VEH is being used.

NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), &ReturnLength);
PPEB pPEB = (PPEB)pbi.PebBaseAddress;
SIZE_T Written;
DWORD64 CrossProcessFlags = -1;
ReadProcessMemory(hProcess, (PBYTE)pPEB + 0x50, (LPVOID)&CrossProcessFlags, sizeof(DWORD64), &Written);
printf("[*] CrossProcessFlags : %p\n", CrossProcessFlags);
if (CrossProcessFlags & 0x4) {
printf("[*] veh set\n");
}
else {
printf("[*] veh unset\n");
}

VEH Debugger usually uses Hardware breakpoint. Verify hardware bp is set

HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, tid);
CONTEXT ctx;
memset(&ctx, 0, sizeof(CONTEXT));
ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
ctx.Dr0 = 0;
ctx.Dr1 = 0;
ctx.Dr2 = 0;
ctx.Dr3 = 0;
ctx.Dr7 &= (0xffffffffffffffff ^ (0x1 | 0x4 | 0x10 | 0x40));
SetThreadContext(hThread, &ctx);
CloseHandle(hThread);