Debugger

Articles Metasploit Framework Windows Tutorial Remote Desktop Connection Windows Processes That May Be Dangerous How-To use NetCat a Tutorial Common Linux Commands Common Ports Netcat Commands HTTP Response Codes War-Google Hack Terms Wardriving Avoiding Social Engineering and Phishing Attacks Intrusion Detection on Linux Linux Intrusion Detection Penetration Testing Guide Penetration Testing Tools Social Engineering Fundamentals, Part I: Hacker Tactics Social engineering (computer security) The Psychology of Social Engineering The Archives General GSO GovernmentSecurity.org News & Suggestions In The News Open Topic General Security Information Trash Can Exploit & Vulnerability Mailing List Archives Trial Member Forum Product and Program Reviews GSO Tutorials System Security Windows Systems Beginners Section Linux & Unix Systems File Downloads Exploit Research & Discussion Trojan & Virus Errata Networking Security / Firewall / IDS / VPN / Routers System Hardening E-Mail Security Wifi Security Trial Member Uploads Upload discovered Trojans & Mal ware GSO Programming Section C , C++ , VC++ Visual Basic .NET Perl /CGI Java/Javascript PHP/XML/ASP/HTML Assembly + Other The Cork Board Network Security Consultant Directory Network Security Jobs The Archives Encryption Information General Network Security Internet Anonymity HTTP Protocol Security Linux Security MS IIS Information Exploit Articles Programming / Tool Design GSO Software Projects Public Downloads Microsoft Security Questions and Papers		Help - Search - Member List - Calendar Full Version: Debugger GovernmentSecurity.org > GSO Programming Section > C , C++ , VC++ aapje Jul 20 2005, 03:18 AM Hey, I would like to fake that a program is being debugged. So like a real debugger does, set a is debugged flag, but how? In c/c++ what is the way to set the debug flag of another program? Thanks. nolimit Jul 20 2005, 03:52 AM The debug flag is set in the TEB (Thread environment block). The easiest and I think best way to evade being detected is performing the following code CODE 00D6CA8F > 64:A1 18000000 MOV EAX,DWORD PTR FS:[18] 00D6CA95 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30] 00D6CA98 C640 02 00 MOV BYTE PTR DS:[EAX+2],0 with that set , kernel32.IsDebuggerPresent will return 0, and any userland self checks will fail. akcom Jul 26 2005, 11:56 PM actually, thats the Process Enviroment Block. FS:[18h] has the address of the TEB, but at 30h of the TEB, there is a pointer to the PEB This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here. Invision Power Board © 2001-2005 Invision Power Services, Inc.