PDA

View Full Version : Question about a self-debugging program


kcynice
June 17th, 2008, 22:15
I read some documents and know that one application can create another process to debug this program. In addition, i found some examples about cracking such programs were using ring0 level debugger like softICE.
So, I wanna to know if such applications can be debugged by a ring3 debugger,like OllyDbg?
If so, how to debug it?

evlncrn8
June 18th, 2008, 00:22
well you'd have to attach to each process with olly, and bounce between then i guess...

kcynice
June 18th, 2008, 01:48
but, did you mean debug them at meantime?
I think its a little too difficult.
for the main program(being debugged by the second process),if you debugged it using a ring0 debugger, all is ok, but if using a ring3 debugger like OllyDgb, the program will crash

Admiral
June 18th, 2008, 04:28
This type of protection is not uncommon but it is rare to find it implemented in a rigid way, mainly because it's so difficult to spread the workload across both processes. Armadillo's Debug Blocker feature, for example, spawns two instances of the program, with one debugging the other. But because the protection is applied retroactively it is very difficult to enforce a necessity for both processes to remain alive. In this instance, the debuggee process does all the work of the underlying program while the debugger makes a token effort to remain attached. With some work it is possible to detach the parent process and attach your own ring3 debugger if desired, thus overcoming a large portion of the protection.

Perhaps the main constraining factor here is that a process may be debugged by at most one other user-mode process at any time, using the Win32 Debug API. For this reason it is often easier to use a ring0 debugger, which can do pretty much what it likes. However this is far less convenient and so we aim to remove the unwanted debugger whenever possible. Other solutions exist, such as the AttachAnyway plugin for Olly which bypasses the OS's 'one-at-a-time' rule. Obviously, this privilege doesn't come without its costs but sometimes it's all you need. Alternatively, if the job can be done without using the Win32 Debug API then there is nothing stopping you using one of the many non-intrusive debuggers, which trade-off some power for anonymity.

kcynice
June 18th, 2008, 09:34
but now, most of the ring3 debuggers use windows api, OllyDbg included. So, we can't use a ring3 debugger to bypass this tricks, right?

Admiral
June 18th, 2008, 13:12
Mmm, I thought I covered that
As far as I can tell, all ring3 debuggers use the Debug API unless they claim to be non-intrusive. If you're not sure what that is, Google it and take a look on the CRCETL. Nevertheless, there are ways of confusing the OS sufficiently to allow a typical ring3 debugger to attach to a process that's already running under another ring3 debugger. Take a look at AttachAnyway if you don't believe me

kcynice
June 18th, 2008, 22:33
yes. I also have seen the thread attachanyway at the forum of openrce.org.
But i didn't read it carefully. Then i will return to the thread and read it carefully. Thanks