OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Topic created on: September 20, 2007 08:58 CDT by Pnluck .

I'm analyzing a thing (a packer from china I believe), and I found this code



MOV EAX,DWORD PTR FS:[30] //0x7ffdd030

MOVZX EAX,BYTE PTR DS:[EAX+2]

I would know to which structure the fs:[30] point to. Thx

jms		September 20, 2007 09:11.31 CDT
That pointer is pointing to the Thread Information Block described here. At that particular offset in the TIB struct points to the Process Environment Block (PEB)described here Quite possibly it will be looking at some of the PEB information to determine if a debugger is attached, we discussed some of this in the LDR_MODULE (Anti-Debugging) thread. Hope this helps.

jms		September 20, 2007 09:35.05 CDT
Oh and if you are using ImmunityDebugger you can just use: `peb = imm.getPEB() peb_addr = imm.getPEBaddress()` Here is what this looks like:

lafkuku		September 20, 2007 11:47.37 CDT
> jms: That pointer is pointing to the Thread Information Block described here. > > At that particular offset in the TIB struct points to the Process Environment Block (PEB)described here > > Quite possibly it will be looking at some of the PEB information to determine if a debugger is attached, we discussed some of this in the LDR_MODULE (Anti-Debugging) thread. Hope this helps. Yea the +2 offset is where the isDebuggerPresent variable lives. So it's basically, checking for a debugger without making the call the the isDebuggerPresent API.

jms		September 20, 2007 11:50.37 CDT
Dami posted his one liner: `imm.writeMemory(imm.getPEBaddress()+2, "\x00")` On the Immmunity Forum

Pnluck		September 20, 2007 12:34.45 CDT
Thanks for the help =)

anonymouse		September 21, 2007 11:22.51 CDT
lkd> dt nt!_TEB ProcessEnvironmentBlock ProcessEnvironmentBlock.BeingDebugged +0x030 ProcessEnvironmentBlock : Ptr32 _PEB +0x002 BeingDebugged : UChar

Note: Registration is required to post to the forums.

There are 31,328 total registered users.

Imagery

SoySauce Blueprint
Jun 6, 2008