Comments on: Anti-Debugging Series – Part III http://www.veracode.com/blog/2009/01/anti-debugging-series-part-iii/ Application security testing, analysis, and metrics Mon, 01 Mar 2010 15:54:23 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: jn http://www.veracode.com/blog/2009/01/anti-debugging-series-part-iii/comment-page-1/#comment-3297 jn Tue, 23 Feb 2010 03:21:49 +0000 http://www.veracode.com/blog/?p=589#comment-3297 "If a debugger is attached and we pass in 0x11 to NtSetInformationProcess, our process will immediately detach any attached debugger and terminate the process." This statement is not correct: 1) you are actually referring to NtSetInformationThread 2) the process is not terminated but debug events for the specified thread are not received by the debugger anymore. “If a debugger is attached and we pass in 0×11 to NtSetInformationProcess, our process will immediately detach any attached debugger and terminate the process.”
This statement is not correct:
1) you are actually referring to NtSetInformationThread
2) the process is not terminated but debug events for the specified thread are not received by the debugger anymore.

]]> By: HuRrIcAnE http://www.veracode.com/blog/2009/01/anti-debugging-series-part-iii/comment-page-1/#comment-2502 HuRrIcAnE Sat, 31 Jan 2009 04:14:07 +0000 http://www.veracode.com/blog/?p=589#comment-2502 I'm one of the fan here, and I wanna said that these type of subjects are increduble .. And I agree the abover's comment that these functions are not that much difficult to bypass its. But what I'm trying to said that the Art of REC is not just for having fun on CRACKING programs and protections, It's like to learn, to improve something, even if it's useless. what I'm agree here is that many private and public schemes will at less use this art of protection in somehow, somewhere to but it at that greatfull steps . I hope Mr. Shields to continue your path and I'm one of your followers. Thanks I’m one of the fan here, and I wanna said that these type of subjects are increduble .. And I agree the abover’s comment that these functions are not that much difficult to bypass its. But what I’m trying to said that the Art of REC is not just for having fun on CRACKING programs and protections, It’s like to learn, to improve something, even if it’s useless.

what I’m agree here is that many private and public schemes will at less use this art of protection in somehow, somewhere to but it at that greatfull steps .

I hope Mr. Shields to continue your path and I’m one of your followers.

Thanks

]]> By: A John Doe http://www.veracode.com/blog/2009/01/anti-debugging-series-part-iii/comment-page-1/#comment-2429 A John Doe Thu, 08 Jan 2009 23:55:41 +0000 http://www.veracode.com/blog/?p=589#comment-2429 Meh, API anti-debugging techniques are fairly useless. Reverse engineers are very familiar with them and they are exceedingly easy to bypass. Might as well use them a bit anyway because they are so easy to implement, but they should be a part of a MUCH MUCH stronger defensive scheme. If they form a notable percentage of the defensive scheme, time is being wasted that could be spent making the defended asset better IMO. Meh, API anti-debugging techniques are fairly useless. Reverse engineers are very familiar with them and they are exceedingly easy to bypass. Might as well use them a bit anyway because they are so easy to implement, but they should be a part of a MUCH MUCH stronger defensive scheme. If they form a notable percentage of the defensive scheme, time is being wasted that could be spent making the defended asset better IMO.

]]> By: Adam Leyshon http://www.veracode.com/blog/2009/01/anti-debugging-series-part-iii/comment-page-1/#comment-2428 Adam Leyshon Thu, 08 Jan 2009 14:07:16 +0000 http://www.veracode.com/blog/?p=589#comment-2428 Very informative, I wish MS would document these functions better as they can be quite handy sometimes. Very informative, I wish MS would document these functions better as they can be quite handy sometimes.

]]>