Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  Bypassing Debugger Detection on DeusEx - Human Revolutions

Topic created on: August 26, 2012 16:14 CDT by fjjf .

I'm trying to bypass the debugger detection but an CPP_EXCEPTION_CODE (0xE06D7363) causes the progam to terminate!

The exe file can be downloaded at http://fjjf.us.to/dxhr4.rar

So far, I've found that the exception is being raised at 00AD9E9F with or without the debugger hooked. The difference is that when the debugger is not hooked, the exception doesn't cause the program to terminate.

On the other hand, I tried to find the handler for the exception following the SEH but couldn't find any applicable handler (i.e. no handler in the SE Chain gets executed).

Can anyone shed some light please?
thanks

  waleedassar     August 26, 2012 20:49.29 CDT
Have you considered the "UnhandledExceptionFilter" function trick?

  fjjf   August 26, 2012 22:32.04 CDT
> waleedassar: Have you considered the \"UnhandledExceptionFilter\" function trick?

thanks for your reply.
well i dont know that trick.... could you point me to some docs about that trick?

  waleedassar     August 26, 2012 23:48.51 CDT
You can refer to Peter ferrie's "Ultimate Anti-Debugging Reference" where you will find it explained in detail.

http://pferrie.host22.com/papers/antidebug.pdf

You can also use my "HookSysCalls" OllyDbg plugin to bypass this trick. The plugin is tested on Windows 7 SP0/SP1 and XP SP2/SP3.
http://code.google.com/p/myollyplugins/downloads/detail?name=HookSysCalls.dll

  waleedassar     August 28, 2012 00:09.44 CDT
Actually, your executable links to a library that does not exist on my system.

Anyway, if the first SEH does not execute after you have instructed the debugger to pass the exception to the application (Shift+F9 in OllyDbg), then you should doubt about the Vectored exception handler (registered by calling the "AddVectoredExceptionHandler" function with the "FirstHandler" parameter set to nonzero).

But if all the registered SEH's execute and then application terminate, then this should be due to the "UnhandledExceptionFilter" function trick.

  fjjf   August 30, 2012 10:59.32 CDT
hi you were right it was because of an UnhandledExceptionFilter. Fixed it and got a goodboy (if thats how you call it LOL) thanks!

Note: Registration is required to post to the forums.

There are 31,314 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit