Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  NTGlobalFlag in Olly

Topic created on: October 15, 2007 18:04 CDT by bodzcount .

In the help of OllyAdvanced it says

NOTE: This will make the plugin NtGlobalFlag which is useful for Execryptor unusuable. Disable it if you deal with Execryptor. This should be only activated in some special cases where Debugger is detected through Registry. Disable it if not REALLY NEEDED!!!

however, the NtGLobalFlag plugin works for me, no matter how i set NtGlobalFlag in ollyadvanced.

Can anybody explain to me why that is?

PS: execryptor apps doent run in olly, when I dont check NtGlobalFlag in ollyadvanced. Why does the help to ollyadvanced say that it should be disabled?

  sovietskicpu     October 15, 2007 18:25.26 CDT
because messing with global flags can cause mess

  bodzcount     October 15, 2007 18:39.38 CDT
but i have to set the globalflag to 0, otherwise execryptor apps dont run. What mess can happen when i do that?

  nezumi     October 15, 2007 18:40.15 CDT
the answer is here and here

  bodzcount     October 15, 2007 18:47.49 CDT
nice articles, however they dont say that changing NtGlobalFlag is evil....
Why should is it dangerous to do it?

  nezumi     October 15, 2007 19:06.16 CDT
NtGlabalFlag is a field in PEB, and since PEB isn't documented better don't patch it. imagine what happens if PEB will change in the future win-version. however, if it works, everything is fine, don't worry.

  anonymouse     October 16, 2007 11:47.06 CDT
any application that is debugged uses DebugHeap Enabled by default  and i think (not sure never used it much to check it out fully) ollyadvanced turns off the DebugHeap to null (post initialization of LdrpInitialize() which means only
those applications that explicitly check ntglobalflag will be fooled and those application that check the heap for heap length and debugheap tags and its signatures and the ForceFlags Siggnature of debugHeap will not be fooled  

you can read a few things about the process in this thread
http://forum.exetools.com/showthread.php?t=7363 especially the part where the discussion is about HideDebugger Plugin versus NtglobalFlag patching is talked about (some functions explicitly need Debug Functionalities to work properly Like Dbgprint()

you can take a look at the sources of the plugin that used this mechanism at this link

http://www.reversing.be/article.php?story=20050603193932184

as long as you know what you are doing patching isnt evil :)

Note: Registration is required to post to the forums.

There are 31,316 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit