首页
社区
课程
招聘
有没人能介绍下odbg的“附加”过程和函数
发表于: 2005-11-8 15:01 4498

有没人能介绍下odbg的“附加”过程和函数

2005-11-8 15:01
4498
现在越来越多的程序反调试反的利害。想做个工具绕过这些反调试。哪位大虾能介绍下od附加进程的相关技术,过程,和函数等等。

[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

收藏
免费 0
支持
分享
最新回复 (3)
雪    币: 339
活跃值: (1510)
能力值: ( LV13,RANK:970 )
在线值:
发帖
回帖
粉丝
2
说白了就是自己打算弄个有附加功能的调试器.
2005-11-8 17:53
0
雪    币: 316
活跃值: (336)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
不是,要能做出调试器,做出附加应该不算多大的问题吧。只想知道od是怎么附加,或者说一般无法附加是因为什么原因。然后写点小程序绕过。好像没见有帖子说过这方面的内容。
2005-11-8 20:23
0
雪    币: 316
活跃值: (336)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
跟了一下,发现od用的是KERNEL32.DebugActiveProcess函数,这第一个函数就失败了。具体原因不明中。搜了一下论坛,没有关于anti DebugActiveProcess的帖子。有没高手指教一下。

You can’t attach 2 debuggers to 1 process
Posted from Microsoft WebBlogs at 2004-12-11 14:58:00

For both managed-only and native-only debugging, you can only attach 1 debugger to a process.

Why?

The native debugger steals debug events from underneath the managed debugger. This confuses the managed-debugger and will cause it to crash. The native debugger has no way of coordinating with the managed-debugger here.

Troubles enforcing this:

In windows, the OS enforces that only 1 native debugger can be attached to a debuggee at a time (DebugActiveProcess to an already-debugged process will fail).

The Managed-only debugging services have similar checks to enforce that only 1 managed debugger can attach to a debuggee at a time.

Managed-only debugging is actually separate from native-only debugging. (This is related to using a helper-thread). If a process is being managed-only debugged, the OS does not view it as being native-only debugged.

This allows the loophole to attach 1 managed and 1 native debugger to an app at the same time. That would circumvent the checks.

To make matters worse, we can’t fully detect this scenario. The native debug APIs know nothing of managed-debugging, and so can’t enforce this. The inprocess-portion of the managed-debugging APIs could call IsDebuggerPresent to check if a native-debugger is attached, but the native-debugger could attach between such calls. There’s also not a good way for the managed debugger to respond even once it detects this situation.

Why would anybody want to do this?

There are actually a few scenarios to motivate attaching multiple debuggers to an app.

1)      Getting more functionality ? A native-only debugger can only debug the native portions of the app. Likewise, A managed-only debugger can only debug the managed-only portions of the app. So what if you want to debug a mixed app with both managed and native code?  One solution would be to attach both debuggers and use them simultaneously. (I think this is what you’d have to do in other similar scenarios; such as debugging VB6 calling native COM objects). We developed interop-debugging (aka “mixed-mode”) to explicitly enable this scenario. It allows a single debugger to debug both the managed and native portions of the app. Visual Studio supports mixed-mode debugging.

2)      Debugging servers. Some server apps (like ASP.Net + SQL) may run code on behalf of multiple users. Ideally, each user could just attach a debugger simultaneously and debug their portion of the code running on the server.  We hope to support these scenarios in a future CLR version via per-appdomain debugging (instead of just per-process debugging).
2005-11-8 23:12
0
游客
登录 | 注册 方可回帖
返回
//