Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  Timing anti-debugging techniques

Topic created on: June 23, 2010 11:58 CDT by scd .

Hello,
I am reversing a binary that has integrity checks (so i can not modify it or use sbp) and timing controls (using GetTickCount and QueryPerformanceCounter)

Till now, i have been using python scripts with immunity debugger monitoring the code just at dlls, but the sw kicks me when the timing techniques start to work, because of the (huge) delay of the python scripts.

I tried then to hook those timing methods with python scripts to return in EAX a low value, but then it turns incredibly slow and the binary doesn't seems to work fine.

I dont know if i should modify the dll (so there would be no python layer to slow it down) or use Ida Pro with a ring0 debugger to be able to forget about tricks and be able to work with real staff :D

What would you recommend me?

  RolfRolles     June 23, 2010 14:20.56 CDT
I would recommend proper C/C++ DLL injection, or maybe running the software in a machine emulator like Bochs/QEMU.  Dynamic instrumentation might also be worth a try.  A ring zero debugger would not necessarily save you if you must pause the process' execution in any form.

Despite the integrity checking, you may be able to make a limited number of modifications by putting hardware read  breakpoints on the code that you've modified.  If you find that the area in question is integrity checked by four or less particular instructions, you can set conditional hardware execution breakpoints on those locations to force them into returning the original values before the patching.  This might run afoul of the timing checks, however.

  scd     June 25, 2010 10:14.20 CDT
Thanks for your answer, I decided to modify the dll, here is the script to patch them, maybe is usefull for somebody, but be careful with the dll version, maybe is not working with all of them.

It is a python script for Immunity Debugger, once you run it, you have to modify the kernel.text access to "Full Access" (I didnt know how do this from the script)

from immlib import *

imm = Debugger()

def GetTickCount():
# I want to know the real tick count of the system
ticks=imm.readLong(0x7FFE0000)
factor=imm.readLong(0x7FFE0004)
ticks*=factor
ticks>>=0x18
return ticks

def main(args):
# Get the ticks
ticks=GetTickCount()
buffer=""
# Write the current ticks into the buffer
for i in range(4):
buffer+=chr((ticks&(0xFF<<(i*8)))>>(i*8))
# Create the new code
buffer+="\xA1\x2A\x93\x80\x7C\x83\xC0\x10\xA3\x2A\x93\x80\x7C\xC3\x90"

addr=imm.getAddress("kernel32.GetTickCount")
# I will use the 4 bytes of before (NOPs) to store the number of ticks
addr-=0x4
imm.writeMemory(addr,buffer)
# imm.setHardwareBreakpoint(addr,2,4)

# Both QueryPerformanceFrequency and QueryPerformanceCounter will
# return 0
buffer="\xB8\x00\x00\x00\x00\xC2\x04\x00"
addr=imm.getAddress("kernel32.QueryPerformanceFrequency")
imm.writeMemory(addr,buffer)
# imm.setHardwareBreakpoint(addr,2,4)

addr=imm.getAddress("kernel32.QueryPerformanceCounter")
imm.writeMemory(addr,buffer)
# imm.setHardwareBreakpoint(addr,2,4)

return "Done"

Note: Registration is required to post to the forums.

Active in Last 5 Minutes
waleedassar

There are 28,224 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit