📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  Timing anti-debugging techniques

Topic created on: June 23, 2010 11:58 CDT by scd .

Hello,
I am reversing a binary that has integrity checks (so i can not modify it or use sbp) and timing controls (using GetTickCount and QueryPerformanceCounter)

Till now, i have been using python scripts with immunity debugger monitoring the code just at dlls, but the sw kicks me when the timing techniques start to work, because of the (huge) delay of the python scripts.

I tried then to hook those timing methods with python scripts to return in EAX a low value, but then it turns incredibly slow and the binary doesn't seems to work fine.

I dont know if i should modify the dll (so there would be no python layer to slow it down) or use Ida Pro with a ring0 debugger to be able to forget about tricks and be able to work with real staff :D

What would you recommend me?

  RolfRolles     June 23, 2010 14:20.56 CDT
I would recommend proper C/C++ DLL injection, or maybe running the software in a machine emulator like Bochs/QEMU.  Dynamic instrumentation might also be worth a try.  A ring zero debugger would not necessarily save you if you must pause the process' execution in any form.

Despite the integrity checking, you may be able to make a limited number of modifications by putting hardware read  breakpoints on the code that you've modified.  If you find that the area in question is integrity checked by four or less particular instructions, you can set conditional hardware execution breakpoints on those locations to force them into returning the original values before the patching.  This might run afoul of the timing checks, however.

  scd     June 25, 2010 10:14.20 CDT
Thanks for your answer, I decided to modify the dll, here is the script to patch them, maybe is usefull for somebody, but be careful with the dll version, maybe is not working with all of them.

It is a python script for Immunity Debugger, once you run it, you have to modify the kernel.text access to "Full Access" (I didnt know how do this from the script)

from immlib import *

imm = Debugger()

def GetTickCount():
# I want to know the real tick count of the system
ticks=imm.readLong(0x7FFE0000)
factor=imm.readLong(0x7FFE0004)
ticks*=factor
ticks>>=0x18
return ticks

def main(args):
# Get the ticks
ticks=GetTickCount()
buffer=""
# Write the current ticks into the buffer
for i in range(4):
buffer+=chr((ticks&(0xFF<<(i*8)))>>(i*8))
# Create the new code
buffer+="\xA1\x2A\x93\x80\x7C\x83\xC0\x10\xA3\x2A\x93\x80\x7C\xC3\x90"

addr=imm.getAddress("kernel32.GetTickCount")
# I will use the 4 bytes of before (NOPs) to store the number of ticks
addr-=0x4
imm.writeMemory(addr,buffer)
# imm.setHardwareBreakpoint(addr,2,4)

# Both QueryPerformanceFrequency and QueryPerformanceCounter will
# return 0
buffer="\xB8\x00\x00\x00\x00\xC2\x04\x00"
addr=imm.getAddress("kernel32.QueryPerformanceFrequency")
imm.writeMemory(addr,buffer)
# imm.setHardwareBreakpoint(addr,2,4)

addr=imm.getAddress("kernel32.QueryPerformanceCounter")
imm.writeMemory(addr,buffer)
# imm.setHardwareBreakpoint(addr,2,4)

return "Done"

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit