 |
AutoHotkey Community
Let's help each other out
|
| View previous topic :: View next topic |
| Author |
Message |
SKAN
Joined: 26 Dec 2005
Posts: 5894
|
 Posted: Fri Feb 22, 2008 12:37 am Post subject: |
 |
|
| Clash wrote: | | Umm i think i've kinda been ignored here.. |
Dear Peter,
I thought the following post ( in this topic ) also answered you. 
http://www.autohotkey.com/forum/viewtopic.php?p=180186#180186
That ASM code is no good as is. We need one ASM programmer would could provide us machine code reusable in AHK.
As observed by Laszlo, this method is not really a great solution, but enough to stop a intermediate user.
Regards, |
|
| Back to top |
|
 |
DeWild1
Joined: 30 Apr 2006
Posts: 172
Location: Shigle Springs
|
| Posted: Fri Feb 22, 2008 12:48 am Post subject: |
|
|
Clash...
It is really my fault sorry. In my stupidity, I thought it was an AHK script.. It is not.
It is ASM code from Adam ( kakeeware.com ).
I should listen to my own saying.. "It is better to sit there and look stupid, rather than to open my mouth and remove all doubt."
Sorry, I need to think and read before I post..  
_________________
CPULOCK.com
virusSWAT.com
GuaranteedPCFIX.com
911PCFIX.com |
|
| Back to top |
|
|
Laszlo
Joined: 14 Feb 2005
Posts: 4016
Location: Pittsburgh
|
| Posted: Fri Feb 22, 2008 2:12 am Post subject: |
|
|
| ManaUser wrote: | | if they can actually power down and switch OSes while the code is in memory there's nothing you can do about it. |
They can run the code as is, but if it was well scrambled, they don't know what it does, nor can they extract parts of it.
| Clash wrote: | | how to use your [debugger catching] script |
I guess, you have to compile it and include in your script as a machine code function. Call it from a timer subroutine once in every few seconds. When it detects a debugger, it exits the process. However, if the debugger is already running when you start your script, it can stop execution before this check takes place, and disable it. This kind of debugger catching is not very effective. |
|
| Back to top |
|
|
Guest
|
| Posted: Fri Feb 22, 2008 2:22 am Post subject: |
|
|
| SKAN wrote: | | We need one ASM programmer would could provide us machine code reusable in AHK. |
I don't think need to program it again in ASM. All necessary machine code is already revealed there. What it really does are: MessageBoxA & ExitProcess. The MessageBoxA is not essential here, only is ExitProcess. BTW, looks like the author forgot that ExitProcess requires one parameter. Anyway, I believe it's still not that protective, there is a way to workaround it. |
|
| Back to top |
|
|
SKAN
Joined: 26 Dec 2005
Posts: 5894
|
| Posted: Fri Feb 22, 2008 3:28 am Post subject: |
|
|
| Laszlo wrote: | | Call it from a timer subroutine once in every few seconds. When it detects a debugger, it exits the process. |
No Sir. Actually I wanted the ASM code to loop itself and exit on debug attach.
We can call it in a seperate thread with CreateThread() and forget it.
All in, if this can be done within 10 lines of AHK Code, it would be worthy.
|
|
| Back to top |
|
|
Guest
|
| Posted: Fri Feb 22, 2008 4:05 am Post subject: |
|
|
| SKAN wrote: | | Laszlo wrote: | | Call it from a timer subroutine once in every few seconds. When it detects a debugger, it exits the process. |
Actually I wanted the ASM code to loop itself and exit on debug attach. |
There is no need of SetTimer or Loop here. It overwrites the function. |
|
| Back to top |
|
|
Clash
Joined: 27 Jun 2006
Posts: 182
|
| Posted: Sat Feb 23, 2008 2:31 pm Post subject: |
|
|
Couldn't i just have this ASM code extracted to some non-immediate folder like the temp folder, and have the ahk script open it every few seconds? surely that'd deter the amature decompiler.
Apart from that script, are there any other tricks i can use?
_________________
  |
|
| Back to top |
|
|
tic
Joined: 22 Apr 2007
Posts: 1356
|
| Posted: Sat Feb 23, 2008 3:36 pm Post subject: |
|
|
| that would be a very annoying method, running a new exe every few seconds as it would put more strain on your hdd than was necessary, so programs would slow down every time it was run. |
|
| Back to top |
|
|
Azerty
Joined: 19 Dec 2006
Posts: 72
Location: France
|
| Posted: Sun Feb 24, 2008 4:21 am Post subject: |
|
|
Hi
In reply to :
this one does basically the same as the ASM source code at http://www.kakeeware.com/i_antiattach.php :
| Code: | /*
Code injection sample
LHdx 2008/02
Credits to Adam Blaszczyk - http://www.kakeeware.com
*/
setformat, integer, h
x:=RegisterCallback("kloug")
m:=DllCall("Kernel32\GetModuleHandle", "Str", "ntdll.dll", "UInt")
a:=DllCall("Kernel32\GetProcAddress", "UInt", m, "Str", "DbgUiRemoteBreakin", "UInt")
disp:=x-5-a
DllCall("kernel32\VirtualProtect", "UInt", a, "UInt", 1, "UInt", 0x40, "UInt *", o, "UInt")
NumPut(0xe9, a+0, 0, "UChar")
NumPut(disp, a+1, 0, "Int")
DllCall("kernel32\VirtualProtect", "UInt", a, "UInt", 1, "UInt", o, "UInt *", o, "UInt")
msgbox I'm in now...
kloug()
{
msgbox "Stop trying to crack me"
}
|
Edit: corrected NumPut's - thx Lazslo
Last edited by Azerty on Sun Feb 24, 2008 5:12 am; edited 1 time in total |
|
| Back to top |
|
|
Laszlo
Joined: 14 Feb 2005
Posts: 4016
Location: Pittsburgh
|
| Posted: Sun Feb 24, 2008 4:34 am Post subject: |
|
|
Do you mean | Code: | NumPut(0xe9, a, 0, "UChar")
NumPut(disp, a, 1, "Int") |
or | Code: | NumPut(0xe9, a+0, 0, "UChar")
NumPut(disp, a+1, 0, "Int") |
|
|
| Back to top |
|
|
DerRaphael
Joined: 23 Nov 2007
Posts: 462
Location: Heidelberg, Germany
|
| Posted: Sun Feb 24, 2008 8:06 am Post subject: |
|
|
FYI here is the workaround for the ASM code: http://www.woodmann.com/forum/showthread.php?t=7586
wouldnt it be better to make the script hooking debug routines in windows itself via RCB? so when these are hooked, IMHO a debugger wont work anymore since its own hooks got broken.
at laszlo: why bothering with extra computer who reads out memory: when using a program in userspace an emulated windows is enough to get a memory dump (pretty easy ... for those interested, have a closer look at QEMUs Console Commands) but im sure u knew this already
at skan: i recently discussed with lexikos on irc the possibility to make a ahk dll. theoretically its possible to take a modified script engine, make a list of which compiled code (from ahks source) will be actually used by the script, take origins from sourcecode and recompile the gathered code with a c compiler (eg tcc). afterwards we will have a true PE and no scriptengine anymore. the problem is that due to AHKs license software produced this way has to be OpenSource Software, because it is technically made of sources which were already GPL'd before. So putting the resulted software under a contrary license style to GPL would violate their terms of usage and make the program 'ilegal'. though the program may have more than one license. but this is quite heavy to explain. on gnu.org is a pretty good faq of what GPL is about and whats legals whats not.
greets
derRaphael
_________________
|
|
| Back to top |
|
|
SKAN
Joined: 26 Dec 2005
Posts: 5894
|
| Posted: Sun Feb 24, 2008 6:06 pm Post subject: |
|
|
@Azerty: Many thanks, for the code and and your kindness.
@derRaphael:  .. We will discuss it on IRC. |
|
| Back to top |
|
|
DeWild1
Joined: 30 Apr 2006
Posts: 172
Location: Shigle Springs
|
|
| Back to top |
|
|
SKAN
Joined: 26 Dec 2005
Posts: 5894
|
| Posted: Thu Feb 28, 2008 1:13 pm Post subject: |
|
|
Dear Azerty,
What does Suspend ( of SysInternals Process Explorer ) do ?
I thought it should suspend a process !?
I tried suspending your script and then attach, but to my joy it still works.
Can you throw some light on this ?
|
|
| Back to top |
|
|
Azerty
Joined: 19 Dec 2006
Posts: 72
Location: France
|
| Posted: Mon Mar 03, 2008 9:04 am Post subject: |
|
|
Skan :
I think what it does is the following : using something similar to ListProcessThreads() in Taking a Snapshot and Viewing Processes, it calls SuspendThread(). Once done, since it doesn' monitor new threads for the process (which shouldn't be able to appear since process is suspended...), it doesn't suspend the new thread created for debug session as stated there : This antidebugging trick works, because anytime a debugger is attaching itself to a debugee, system creates a new thread, which starts at DbgUiRemoteBreakin (ntdll!DbgUiRemoteBreakin) function in debugee's process space.
There's no SuspendProcess() in Windows... 
[ Moderator!: links were fixed ] |
|
| Back to top |
|
|
|
|
You can post new topics in this forum
You can reply to topics in this forum
|
Powered by phpBB © 2001, 2005 phpBB Group
|
FAQ
Search
Memberlist
Register
Profile
Log in to check your private messages
Log in
