nezumi-lab
February 13th, 2009, 23:19
another anti-attach trick. during attaching to the process, operation system creates a thread inside it and as far as we know, every thread has the start address. the address of the system thread is BaseThreadStartThunk. it calls BaseAttachComplete, who calls DbgBreakPoint in order to raise the breakpoint exception to pass control back to debugger. so, if we block BaseThreadStartThunk somehow, DbgBreakPoint will be never called and a debugger will never get control. theoretically…
…practically, operation system notifies a debugger when a new thread is about to be created, thus a debugger does not need in DbgBreakPoint at all!!! just set Option\Debugger option\Events\Break on new thread in Olly or Debug\Debugger options\Stop on thread start/exit in IDA-Pro and enjoy!!!
but, there is something else. first of all - these options are not set by default. second of all - if the system thread issues an exception - we can’t just continue execution! we need to kill the system thread to suppress the exception - not every hacker knows it and not every debugger allows us to do it (IDA-Pro does not).
well, guess, “Break on new thread” is set. this means our debugger stops _before_ executing the first command of BaseThreadStartThunk. how we’re going to generate an exception?! it’s easy! page of BaseThreadStartThunk => NO_ACCESS! of course, operation system will send exception notification to the debugger, allowing us to kill the system thread and continue executing/tracing the main one, but as it was said above not every hacker are ready to handle this situation.
ok, lets play with this trick. be warned: it’s not safe. we can’t set no access only for BaseThreadStartThunk, it affects the whole memory page where might be essential functions, but… for W2K/XP/S2K3 it works well. just… BaseThreadStartThunk is not an exported function. so, how we’re going to find where it’s located in memory? guess, the most universal way is to create a child process, attach to it, get CREATE_THREAD_DEBUG_EVENT notification and memorize u.CreateThread.lpStartAddress.
download ("http://nezumi-lab.org/ffh/to_attach_39.zip") the sources and binary of the POC to play with.
http://nezumi-lab.org/gif/BaseThreadStartThunk.gifOlly fails to attach and the only way to continue debugging is to kill the system thread
http://nezumi-lab.org/blog/?p=145
…practically, operation system notifies a debugger when a new thread is about to be created, thus a debugger does not need in DbgBreakPoint at all!!! just set Option\Debugger option\Events\Break on new thread in Olly or Debug\Debugger options\Stop on thread start/exit in IDA-Pro and enjoy!!!
but, there is something else. first of all - these options are not set by default. second of all - if the system thread issues an exception - we can’t just continue execution! we need to kill the system thread to suppress the exception - not every hacker knows it and not every debugger allows us to do it (IDA-Pro does not).
well, guess, “Break on new thread” is set. this means our debugger stops _before_ executing the first command of BaseThreadStartThunk. how we’re going to generate an exception?! it’s easy! page of BaseThreadStartThunk => NO_ACCESS! of course, operation system will send exception notification to the debugger, allowing us to kill the system thread and continue executing/tracing the main one, but as it was said above not every hacker are ready to handle this situation.
ok, lets play with this trick. be warned: it’s not safe. we can’t set no access only for BaseThreadStartThunk, it affects the whole memory page where might be essential functions, but… for W2K/XP/S2K3 it works well. just… BaseThreadStartThunk is not an exported function. so, how we’re going to find where it’s located in memory? guess, the most universal way is to create a child process, attach to it, get CREATE_THREAD_DEBUG_EVENT notification and memorize u.CreateThread.lpStartAddress.
download ("http://nezumi-lab.org/ffh/to_attach_39.zip") the sources and binary of the POC to play with.
http://nezumi-lab.org/gif/BaseThreadStartThunk.gifOlly fails to attach and the only way to continue debugging is to kill the system thread
http://nezumi-lab.org/blog/?p=145