SolvedAnti-Debugging
Anti-Debugging
I have always been afraid to release my programs because i didn't want people to crack it, but recently I just thought to myself and decided that if somebody is desperate enough and has no life to just sit and crack my program then so be it, but I will add just the most rudimentary and basic little defenses so the person doing it has to atleast know more than the normal cracker. So that means i will encrypt my strings and so on. There is one thing that I want to know how to do. And that is, when i was debugging my app with ollydbg in the middle box it was displaying the c++ code for that line of asm. I thought that variable names were destroyed when compiled, but apparently not. And it wrote what file in my app it came from like "globals.h". How do i atleast stop this? I know that everyone does it but idk how. Thanks.
People who most likely will know the answer:
@.::SCHiM::.
@Hassan
@Jason
@radnomguywfq3
@Hell_Demon
@Void
People who most likely will know the answer:
@.::SCHiM::.
@Hassan
@Jason
@radnomguywfq3
@Hell_Demon
@Void
http://www.mpgh.net/forum/31-c-c-pro...debugging.html
---------- Post added at 06:12 PM ---------- Previous post was at 06:03 PM ----------
Anti-Debugging Series – Part III
---------- Post added at 06:12 PM ---------- Previous post was at 06:03 PM ----------
Anti-Debugging Series – Part III
Thanks kibbles, I will be reading up on those links. Thanks. Input from more people is appreciated as I think this is a really grey area of programming that more programmers need to know about to protect their stuff more.
---------- Post added at 02:05 AM ---------- Previous post was at 01:06 AM ----------
EDIT:
Kibbles, the NtQueryInformationProcess isn't working anymore i don't think. I tried that guy's method but it didn't work. Either that or I need to work on Dynamic Linking.
---------- Post added at 02:05 AM ---------- Previous post was at 01:06 AM ----------
EDIT:
Kibbles, the NtQueryInformationProcess isn't working anymore i don't think. I tried that guy's method but it didn't work. Either that or I need to work on Dynamic Linking.
Well, I don't have experience with asm and such but for the obfuscation, even at the basic level your code should create lots and lots of delegates that will definitely make the code harder to understand. Also, hide calls to internal and external methods.
Originally Posted by Hassan
Well, I don't have experience with asm and such but for the obfuscation, even at the basic level your code should create lots and lots of delegates that will definitely make the code harder to understand. Also, hide calls to internal and external methods.
Originally Posted by 258456
What do you mean by delegates?
Wow, that seems pretty tricky. I think I will try to implement this. Thanks Hassan.
I released a bit of anti-debugging code a while ago, it should be somewhere in this section.
Originally Posted by Void
I released a bit of anti-debugging code a while ago, it should be somewhere in this section.
Thx hassan and void these r nice techniques but the issue is that when i open it in olly, it stops code execution before the entry point so these precautions won't be of any effect. That's the issue i am having.
Originally Posted by 258456
Thx hassan and void these r nice techniques but the issue is that when i open it in olly, it stops code execution before the entry point so these precautions won't be of any effect. That's the issue i am having.
Originally Posted by freedompeace
Lots of abstractions, decoupling and non-standard ways of doing things (eg. calling conventions) really mess with people's heads. And that's all you can hope to do with these "anti-debugging" (more accurately obfuscation) techniques. Delegation is a type of abstraction.
Originally Posted by 258456
Oh so you're just saying that i should just really mix it up with my coding, lol. I will look it up on google to find more abstraction techniques. Thx freedom
Originally Posted by freedompeace
Themida and friends will also help... a lot.
the easiest way is to pack your programs with a strong packer such as Themida or VMProtect...
@258456
@258456
