OpenRCE: Blog

2 anti-trace mechanisms specific to windows x64

Fri, 08 Mar 2013 16:13:08 -0600

http://everdox.blogspot.com/2013/03/2-anti-tracing-mechanisms-specific-to.html

Advanced debugging techniques

Thu, 07 Mar 2013 09:02:54 -0600

This article explains how from user-mode we can use NtSetInformationProcess to install an InstrumentationCallback which we can use to monitor access to the following callbacks, without actually hooking them in memory.

This member only exists in x64 versions of windows.

LdrInitializeThunk
KiUserExceptionDispatcher
KiRaiseUserExceptionDispatcher
KiUserApcDispatcher
KiUserCallbackDispatcher

as well as all system calls.

Please note that the InstrumentationCallback member of KPROCESS can only be set from user-mode if the target process is NOT running in the wow64 thunk layer. If you want to use this feature for wow64 processes you must use a driver or go in manually with KD.

http://www.codeproject.com/Articles/543542/Windows-x64-system-service-hooks-and-advanced-debu

Branch tracing and LBR access from user-mode in windows.

Wed, 06 Mar 2013 10:48:32 -0600

This article is an in-depth explanation of leveraging access to the debug_ctl MSR's from user-mode and how windows provides access to LBRs in it's ExceptionInformation[] structure.

The article goes on to explain a quick trick I discovered where the last branch can be located when a caller nukes it's call stack prior to a branch.

The article also explains how the features can be used to detect whether or not the program runs under the control of certain hyper-visors.

The in depth article can be found here: http://www.codeproject.com/Articles/517466/Last-branch-records-and-branch-tracing

An older article not by me discussing these features can also be found here: http://www.openrce.org/blog/view/535/Branch_Tracing_with_Intel_MSR_Registers

Using pre-paged in virtual memory as an anti-dumping and anti-debugging mechanism

Tue, 05 Mar 2013 14:00:25 -0600

http://everdox.blogspot.com/2013/03/utilizing-paged-virtual-memory-as-anti.html

Context switches and cycle time counting as anti-debug mechanism

Tue, 05 Mar 2013 13:59:02 -0600

http://everdox.blogspot.com/2013/02/infer-debugger-presense-by-counting.html