Debuggers Anti-Attaching Techniques - Part 2

In the previous post, i talked about the trick of patching the "DbgUiRemoteBreakin" and "DbgBreakPoint" functions and how to circumvent it.

In this post, i am going to analyze another trick. This time, the trick is patching the "NtContinue" function.

We already know the remote thread starts with executing the "DbgUiRemoteBreakin" function.

Trying to find how execution is transferred to the "DbgUiRemoteBreakin" function in the new thread, i found that it is the "NtContinue" function.

Hooking the "NtContinue" function, we can prevent ollydbg from attaching to processes.

Here you can find an demo (Tested with Windows XP SP2 and Windows 7).
 
This trick is bypassed in the same way as that one in Part 1 and can similarly be implemented in an ollydbg plugin.

Update:
I updated the demo in response to a comment. 

You can follow me on Twitter @waleedassar 

Debuggers Anti-Attaching Techniques - Part 1

It's been a while since i played with packing/unpacking tricks. So, i am going to choose some fancy tricks and try to explain them in detail.

The story begins when i was trying to analyze a security issue in an infamous application. I tried to attach ollydbg to the running process but the process immediately crashed. I quickly googled "anti-attach tricks" and found many useful links.

In the next few posts, i am going to explain those anti-attach tricks.

It would surely be better to understand how debuggers attach themselves to running processes in order to understand those tricks and perhaps innovate new ones.

The main idea behind attaching is that a debugger calls the "DebugActiveProcess" function which ends up with calling the "RtlCreateUserThread" function to create a new remote thread into the target process, with the "DbgUiRemoteBreakin" function as the new thread entry point.

Thread creation occurs in the "DbgUiIssueRemoteBreakin" function, which looks something like the highlighted line in the image below.

As far as i see, one way to prevent debuggers from attaching to a process is conducted by hooking the "DbgBreakUiRemoteBreakin" or "DbgBreakPoint" function.

  I will write a simple executable to demonstrate that. It overwrites the first six bytes of the "DbgUiRemoteBreakin" function with some instructions to jump to the "ExitProcess" function. Similarly, we can patch the "DbgBreakPoint" function.

Here you can download the source code for the example above.

Trying to attach to such a process, as you can see in the image below, results into terminating the process.

Bypassing this trick is pretty easy. Just load olly into another instance of olly, set a breakpoint on the "RtlCreateUserThread" function call, and finally modify its seventh paramter to point to any int3 in the target process address space. 

Once execution stops at int3 (in the debugged ollydbg), kill the current thread.

This way we can bypass this anti-attach trick whether the "DbgUiRemoteBreakin" or "DbgBreakPoint" function is patched in the target process address space.

This bypass trick seems to be impractical. So, i decided to write a simple ollydbg plugin for this situation. The plugin simply patches the "DbgUiIssueRemoteBreakin" function in ollydbg.exe to jump to the plugin code. The plugin code gets the process handle from the stack, allocates memory into this process, and finally writes a few instruction to the new memory.

Here you can download the plugin dll.

N.B. This write-up is based on analysis conducted on Windows XP SP3 and WOW64, windows 7.

N.B. The plugin is tested on windows XP SP3 and WOW64, Windows 7. 

You can follow me on Twitter @waleedassar