[REVS] Antidebugging For (M)asses - Protecting the Enviroment

SecuriTeam <[email protected]>
Newsgroups gmane.comp.security.securiteam
Message-ID <[email protected]>
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Antidebugging For (M)asses - Protecting the Enviroment
------------------------------------------------------------------------


SUMMARY

The whitepaper linked here provides a few examples for antidebugging 
techniques that can be used under the Windows operating system.

DETAILS

Introduction:
The number of computer hackers/crackers have reached a very high level 
recently. It is very hard to develop a product that will be secure against 
reverse engineering attacks, to be const-stricto it is surely impossible. 
However, if we can, why not make their dirty work harder?

The paper discusses several techniques:
 * Open CSRSS.EXE to detect SEH debugger
 * Use the CheckRemoteDebuggerPresent API provided by Windows XP
 * Protect ExitProcess to detect Softice/D*

The whitepaper can be found at:  
<http://pb.specialised.info/all/articles/antid.txt> 
http://pb.specialised.info/all/articles/antid.txt


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> Piotr 
Bania.
The original article can be found at:  
<http://pb.specialised.info/all/articles/antid.txt> 
http://pb.specialised.info/all/articles/antid.txt



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.