Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  Timing anti-debugging techniques

Topic created on: June 23, 2010 11:58 CDT by scd .

Hello,
I am reversing a binary that has integrity checks (so i can not modify it or use sbp) and timing controls (using GetTickCount and QueryPerformanceCounter)

Till now, i have been using python scripts with immunity debugger monitoring the code just at dlls, but the sw kicks me when the timing techniques start to work, because of the (huge) delay of the python scripts.

I tried then to hook those timing methods with python scripts to return in EAX a low value, but then it turns incredibly slow and the binary doesn't seems to work fine.

I dont know if i should modify the dll (so there would be no python layer to slow it down) or use Ida Pro with a ring0 debugger to be able to forget about tricks and be able to work with real staff :D

What would you recommend me?

  RolfRolles     June 23, 2010 14:20.56 CDT
I would recommend proper C/C++ DLL injection, or maybe running the software in a machine emulator like Bochs/QEMU.  Dynamic instrumentation might also be worth a try.  A ring zero debugger would not necessarily save you if you must pause the process' execution in any form.

Despite the integrity checking, you may be able to make a limited number of modifications by putting hardware read  breakpoints on the code that you've modified.  If you find that the area in question is integrity checked by four or less particular instructions, you can set conditional hardware execution breakpoints on those locations to force them into returning the original values before the patching.  This might run afoul of the timing checks, however.

  scd     June 25, 2010 10:14.20 CDT
Thanks for your answer, I decided to modify the dll, here is the script to patch them, maybe is usefull for somebody, but be careful with the dll version, maybe is not working with all of them.

It is a python script for Immunity Debugger, once you run it, you have to modify the kernel.text access to "Full Access" (I didnt know how do this from the script)

from immlib import *

imm = Debugger()

def GetTickCount():
# I want to know the real tick count of the system
ticks=imm.readLong(0x7FFE0000)
factor=imm.readLong(0x7FFE0004)
ticks*=factor
ticks>>=0x18
return ticks

def main(args):
# Get the ticks
ticks=GetTickCount()
buffer=""
# Write the current ticks into the buffer
for i in range(4):
buffer+=chr((ticks&(0xFF<<(i*8)))>>(i*8))
# Create the new code
buffer+="\xA1\x2A\x93\x80\x7C\x83\xC0\x10\xA3\x2A\x93\x80\x7C\xC3\x90"

addr=imm.getAddress("kernel32.GetTickCount")
# I will use the 4 bytes of before (NOPs) to store the number of ticks
addr-=0x4
imm.writeMemory(addr,buffer)
# imm.setHardwareBreakpoint(addr,2,4)

# Both QueryPerformanceFrequency and QueryPerformanceCounter will
# return 0
buffer="\xB8\x00\x00\x00\x00\xC2\x04\x00"
addr=imm.getAddress("kernel32.QueryPerformanceFrequency")
imm.writeMemory(addr,buffer)
# imm.setHardwareBreakpoint(addr,2,4)

addr=imm.getAddress("kernel32.QueryPerformanceCounter")
imm.writeMemory(addr,buffer)
# imm.setHardwareBreakpoint(addr,2,4)

return "Done"

Note: Registration is required to post to the forums.

Active in Last 5 Minutes
ta0n
kitochou

There are 29,954 total registered users.


Recently Created Topics
pydbg bp_set_mem
Jun/18
Disassembling Motoro...
Jun/13
ida plugin writing f...
Jun/02
New version of RE-Go...
May/29
Decompiling raw bina...
May/22
Incorrect bitness wh...
May/20
PaiMei stalker modul...
May/19
Attach to program us...
May/13
IDA PRO how to make ...
May/12
FACT: OpenRCE is dead.
May/08


Recent Forum Posts
pydbg bp_set_mem
kitochou
pydbg, memory breakp...
kitochou
Good Binary Code Pro...
alton
Int 3 anti debug?
SteveIRQL
Attach to program us...
SteveIRQL
Ollydbg 2.0 - Plugin...
openrce...
IDA PRO how to make ...
codeinject
FACT: OpenRCE is dead.
codeinject
IDA Resource Viewer ...
r2x64
FACT: OpenRCE is dead.
djnemo


Recent Blog Entries
kitochou
Jun/18
pydbg

lowpriority
Apr/13
OllyMigrate Plugin for Olly...

everdox
Mar/08
2 anti-trace mechanisms spe...

everdox
Mar/07
Advanced debugging techniques

everdox
Mar/06
Branch tracing and LBR acce...

More ...


Recent Blog Comments
newlulu on:
Jun/10
Branch tracing and LBR acce...

newlulu on:
Jun/10
Advanced debugging techniques

newlulu on:
Jun/10
2 anti-trace mechanisms spe...

newlulu on:
Jun/10
OllyMigrate Plugin for Olly...

clarisonic on:
Apr/03
New version of Ollydbg!

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit