labelpoy.blogg.se - Ollydbg debugging program launched by another program

Ollydbg debugging program launched by another program how to#
Ollydbg debugging program launched by another program .dll#
Ollydbg debugging program launched by another program code#

We can see from the scheme how OllyDbg loads the plugin. The plugin operation principle is as follows: Thus the time for measurement is substituted, which prevents the debugger from being detected. This dll replaces the true value of original function with the value set in the main dll. It also has the altered logic of functions that work with time.

Ollydbg debugging program launched by another program code#

The auxiliary dll has the code for setting and removing hooks. It loads the auxiliary dll into the address space of the target process to perform the required actions. The main dll is the plugin that interacts with OllyDbg and has the interface for interaction with auxiliary dll. Start sets up the hooks, and Stop removes them.

Ollydbg debugging program launched by another program .dll#

dll includes exported functions – Start and Stop. This implementation is written in dll loaded into the target process. the pointer of the original function is replaced with the custom function with custom implementation, where the value is substituted. This is implemented by means of function hooks, as such a solution is painless and unnoticeable by an application. Hiding of OllyDbg by execution time substitutes custom time value for the original time, returned by the function.

QueryPerformanceCounter/ QueryPerformanceFrequency.

If there is a too long pause between the instructions – most likely the program has been stopped for analysis. The program can detect such stopping by monitoring the system time. In this case the operation of the program is suspended. The debuggers are capable of making breakpoints in code. Let’s consider the system of debugger identification.

This causes difficulties in application reversing. The OllyDbg has the «HideOD» and «Hide Debugger» anti-debug plugins, which have no possibility to hide actual time. Measuring time to identify that an application is being debugged becomes the widespread practice lately. There are a number of various approaches, like Debug Blocker, Nanomites, others. Serious programs have various means of protection against debugging. Modern computer programs are more complex in writing and more difficult for reversing. This article is intended for people experienced in C++ and dll writing.

Writing the auxiliary module for plugin.

The task is to prevent the application being debugged from detecting the debugger.

Ollydbg debugging program launched by another program how to#

In this article, I will tell you how to write an anti-debug plugin for OllyDbg v.

Download AntiDebugTimePlugin.zip - 166.5 KB.