Skip to content

Latest commit

 

History

History
62 lines (56 loc) · 3.08 KB

README.md

File metadata and controls

62 lines (56 loc) · 3.08 KB
DD - DebugDetector ============================

###Notes

  • This tool should help to test if your debugger is invisible against the targets. Maybe some can learn something about the anti debug techniques while browsing the source. Of course the most things are easy to bypass but you should see what you need to fix in your debugger

  • If you have some ideas, other techniques (no time related things currently) or other suggestions than feel free to contact me!

  • zer0fl4g[at]gmail[dot]com

###Ideas & Techniques & collected Links

###ToDo

  • Add more Plugins
  • Add color incase of debug detection

###Features

  • Plugin Interface
  • simple to use
  • error messages
  • Show percentage of detection
  • x64 support (inline asm needs to be ported to C++ cause visualstudio doesn´t support inline assambler in x64 mode but the other modules should work more or less)
  • 17 Plugins
  • DebugObject
    • Using NtQueryInformationProcess to see if there are Debugging Objects for our process
  • CheckRemoteDebuggerPresent
    • simple api which checks if a debugger is present
  • HardwareBreakpoint
    • checking the current thread for breakpoints in CONTEXT.dr0 - .dr3
  • IsDebuggerPresent
    • simple api which checks if a debugger is present
  • MemoryBreakpoint
    • places a page guard and in case there is no exception we know that we are debugged
  • OpenCSRSS (doesn´t work anymore ?)
    • Opens a handle for csrss , should not be able to without DebuggingFlag
  • OutputDebugString
    • if eax == 1 we are in normal mode. else offset of string is found in eax
  • ParentProcess
    • normaly we run with explorer.exe as parent
  • ProcessDebugFlags
    • uses NtQueryInformationProcess to check if our process has debugflags
  • Unhandled Exception
    • raises a division by 0 exception and in case we are not debugged everything wents good since we capture the exception
  • PEB.BeingDebugged
    • Checks the Process Enviroment Block if the debugbit is set
  • PEB.GlobalFlags
    • checks if flag is set in PEB (FLG_HEAP_ENABLE_TAIL_CHECK && FLG_HEAP_ENABLE_FREE_CHECK && FLG_HEAP_VALIDATE_PARAMETERS)
  • PEB.ProcHeapFlag
    • checks if the ForceFlag is set in the PEB
  • FindBadProcesses
    • enums the process list and checks if given processes are running
  • FindBadWindows
    • enums the window list and checks if given windows are found
  • FindBadDrivers
    • enums the driver list and checks if given drivers are found
  • NTYieldExecution ( by Aguila)
    • uses the NtYieldExecution API to detect if target is debugged