📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  PE Anti-Debugging technique(s) to execute code before OEP

Topic created on: March 4, 2008 06:47 CST by abuse007 .

Hi,

Besides the TLS-Callback technique, is there any other PE anti-debugging techiques to execute code before the OEP?

I have tried searching OpenRCE and Google but not been able to find any.

Thank you in advance.

  fileoffset     March 4, 2008 19:23.04 CST
I don't think so

  r0main     March 5, 2008 06:09.53 CST
Not really an anti-debug technique but DLLs init function is executed before the entry point.

  mikado     June 11, 2008 07:29.34 CDT
actually yes! See following kernel functions:

PsSetCreateProcessNotifyRoutine()
PsSetCreateThreadNotifyRoutine()
PsSetLoadImageNotifyRoutine()

If you're clever, you can "pause" the execution of main thread at process's entry point then create new thread for your tasks before resuming main thread :P.

  Soul12     June 11, 2008 13:10.48 CDT
those api's require a seperate process / driver to run before you execute the .exe or .dll your trying to protect , so not really self contained..

anorther nice trick is to fill the PE with serious invalid Data places where you can..to make Debuggers crash or fail to load the application ..but windows wont mind. i cant remember an example right now..but there is a few :) , as to execution of Code before OEP ..i think sadly not orther then the options mentioned

  abuse007     June 11, 2008 19:32.44 CDT
Thank you all for your replies.

Its good to know that TLS-Callbacks, and DLL inits are the places to check before debugging an untrusted application (in a VM or sandbox).

Cheers.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit