StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p><a href="http://www.symantec.com/connect/articles/windows-anti-debug-reference" rel="nofollow noreferrer">http://www.symantec.com/connect/articles/windows-anti-debug-reference</a></p> <p>read sections 2 "PEB!NtGlobalFlags" and 2 "Heap flags"</p> <p>think this may explain it ...</p> <hr> <p>EDIT: added solution</p> <p>in your handler for CREATE_PROCESS_DEBUG_EVENT, add the following</p> <pre><code>// hack 'Load Configuration Directory' in exe header to point to a new block that specfies GlobalFlags IMAGE_DOS_HEADER dos_header; ReadProcessMemory(cpdi.hProcess,cpdi.lpBaseOfImage,&dos_header,sizeof(IMAGE_DOS_HEADER),NULL); IMAGE_OPTIONAL_HEADER32 pe_header; ReadProcessMemory(cpdi.hProcess,(BYTE*)cpdi.lpBaseOfImage+dos_header.e_lfanew+4+sizeof(IMAGE_FILE_HEADER),&pe_header,offsetof(IMAGE_OPTIONAL_HEADER32,DataDirectory),NULL); IMAGE_LOAD_CONFIG_DIRECTORY32 ilcd; ZeroMemory(&ilcd,sizeof(ilcd)); ilcd.Size = 64; // not sizeof(ilcd), as 2000/XP didn't have SEHandler ilcd.GlobalFlagsClear = 0xffffffff; // clear all flags. this is as we don't want dbg heap BYTE *p = (BYTE *)VirtualAllocEx(cpdi.hProcess,NULL,ilcd.Size,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE); WriteProcessMemory(cpdi.hProcess,p,&ilcd,ilcd.Size,NULL); BYTE *dde = (BYTE*)cpdi.lpBaseOfImage+dos_header.e_lfanew+4+sizeof(IMAGE_FILE_HEADER)+offsetof(IMAGE_OPTIONAL_HEADER32,DataDirectory)+sizeof(IMAGE_DATA_DIRECTORY)*IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG; IMAGE_DATA_DIRECTORY temp; temp.VirtualAddress = p-cpdi.lpBaseOfImage; temp.Size = ilcd.Size; DWORD oldprotect; VirtualProtectEx(cpdi.hProcess,dde,sizeof(temp),PAGE_READWRITE,&oldprotect); WriteProcessMemory(cpdi.hProcess,dde,&temp,sizeof(temp),NULL); VirtualProtectEx(cpdi.hProcess,dde,sizeof(temp),oldprotect,&oldprotect); </code></pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload