Please take a moment to read http://bit.ly/demandglobalchange, to help share the message and support the initiative to tell our leaders to focus on addressing the global world problems, instead of complaining about the effects of their lack of leadership. Be a leader yourself, and share this with as many people as possible. #demandglobalchange // https://www.facebook.com/demandglobalchange



Please consider donating: https://www.corelan.be/index.php/donate/


7,005 views

Anti-debugging tricks revealed – Defcon CTF Qualifications 2009: Bin300 Analysis

Introduction

A while ago I stumbled upon an awesome write-up of a very nice CTF challenge created by sapheads:
http://hackerschool.org/DefconCTF/17/B300.html

I love cartoons, and I love reversing, so I decided to play a little bit with that binary (b300.exe) which was a lot of fun.

Because some interesting anti-debugging tricks were implemented into the binary, I decided to make a short video about the reversing process.

First of all, thanks to KorUPt and Sapheads (http://www.sapheads.org) for the awesome cartoon.
At the time of creating this video, the binary and KOrUPt’s write-up are available here:
http://www.rohitab.com/discuss/index.php?app=core&module=attach§ion=attach&attach_id=2736

Finally, thanks to Defcon and DDTek for this great challenge !

Enjoy!

Video

You can view a full screen version here

You can download the movie here


2011, Corelan Team (fancy). All rights reserved.

Related Posts:

3 Responses to Anti-debugging tricks revealed – Defcon CTF Qualifications 2009: Bin300 Analysis

  • johnnycannuk says:

    Nice…I learned of a few new anti-debug techniques. Doesn’t Immunity’s !hidedebug option patch for these?

    • Corelan Team (fancy) says:

      Nice, thanks.
      Unfortunately hidedebug doesn’t help here.

      1. int3 : it is the debuggers way to set software breakpoints, so it’s a legitimate code. The debugger cannot determine if it is meant for sth. else – the debugger always thinks it’s a software breakpoint.

      2. int 2D: since its exception value is used later to form the start address of the execption handler, there’s no way for patching too. For OllyDbg there is a plugin called StrongOD which claims to “correctly handle the instructions int 2d” but I’m not aware of if it can help in this case. I would say

  • johnnycannuk says:

    Ok good to know…I’ll have to study this more closely in case I run into it in the field.

    Thanks again.

Corelan Live training

Since 2011, Corelan GCV has been teaching live win32 exploit dev classes at various security cons and private companies & organizations.

You can read more about the training and schedules here

Demand Global Change

The world needs your help !

Please take a few moments to read the "Demand Global Change Call For Action" document at
http://bit.ly/demandglobalchange
Read the full document at
http://bit.ly/demandglobalchange_full and share the message with as many people as possible.

Like the Facebook page, and SHARE it with everyone you know.



Donate

Want to support the Corelan Team community ? Click here to go to our donations page.

Want to donate BTC to Corelan Team?



Your donation will help funding server hosting.

Protected by Copyscape Web Plagiarism Tool

Corelan Team Merchandise

You can support Corelan Team by donating or purchasing items from the official Corelan Team merchandising store.

Corelan on IRC

You can chat with us and our friends on #corelan (freenode IRC)

Categories