{"id":668,"date":"2013-12-23T04:37:18","date_gmt":"2013-12-23T04:37:18","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=668"},"modified":"2013-12-23T04:38:54","modified_gmt":"2013-12-23T04:38:54","slug":"other-antidebug-tricks","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2013\/12\/other-antidebug-tricks\/","title":{"rendered":"Other AntiDebug tricks"},"content":{"rendered":"

I came across this one individual’s page<\/a> whom is an avid reverse engineer with some great material.<\/p>\n

Check out his pdf cheat sheet<\/a> on anti-debugging. There were a few in there I didn’t know about like the ‘csr’ trick which involves calling an undocumented ‘CsrGetProcessId’ function within OpenProcess. CsrGetProcessId is a native API that returns the PID of csrss.exe. <\/p>\n

Evidently if you call OpenProcess and pass the ID returned by CsrGetProcessId(), no error will occur if the SeDebugPrivilege has been set with SetPrivilege() \/ AdjustTokenPrivileges(). How about some code with that shake?
\n<\/p>\n

\n
#include <stdio.h><\/span>\r\n#include <windows.h><\/span>\r\ntypedef<\/span> HANDLE<\/span> (*<\/span>_CsrGetProcessId)();\r\n\r\nint<\/span> main<\/span>(void<\/span>)\r\n{\r\nHMODULE nt=<\/span>GetModuleHandle("ntdll.dll"<\/span>);\r\n_CsrGetProcessId CsrGetProcessId=<\/span>(_CsrGetProcessId)GetProcAddress(nt,"CsrGetProcessId"<\/span>);\r\nHANDLE proc =<\/span> OpenProcess(PROCESS_ALL_ACCESS,FALSE,CsrGetProcessId());\r\nif<\/span>(!<\/span>proc)\r\n{\r\nprintf("debugger is present!"<\/span>);\r\n}\r\n}\r\n<\/pre>\n<\/div>\n
The cheat sheet<\/a> has other stuff in it. Check it out some time. Better yet, check out the guy’s blog<\/a> instead.<\/p>\n
Happy cracking!<\/p>\n","protected":false},"excerpt":{"rendered":"
I came across this one individual’s page whom is an avid reverse engineer with some great material. Check out his pdf cheat sheet on anti-debugging. There were a few in there I didn’t know about like the ‘csr’ trick which involves calling an undocumented ‘CsrGetProcessId’ function within OpenProcess. CsrGetProcessId is a native API that returns […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4,7],"tags":[82],"_links":{"self":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/668"}],"collection":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/comments?post=668"}],"version-history":[{"count":3,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/668\/revisions"}],"predecessor-version":[{"id":672,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/668\/revisions\/672"}],"wp:attachment":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/media?parent=668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/categories?post=668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/tags?post=668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}