From Collaborative RCE Tool Library
Anti Debug Test Tools
| Tool name: | xADT eXtensible Anti-Debug Tester |
| ||
|---|---|---|---|---|
| Author: | Shub-Nigurrath | |||
| Website: | http://arteam.accessroot.com | |||
| Current version: | 1.3 | |||
| Last updated: | November 5, 2007 | |||
| Direct D/L link: | http://arteam.accessroot.com/releases.html?fid=33 | |||
| License type: | Free | |||
| Description: | The tool is thought to be an unique extensible platform for integrating all the anti-debugging tricks you might see around, using an unique extensible interface you also might easily extend using plugins. The tool is useful to test the hiding features of the debugging tools and custom loaders as well as the hiding of any other reversing tool: see how well they're hidden or not. The second advantage is to finally have an unique testing program and to not have hundreds of spare tiny programs. The easiness of adding new external tests, writing new plugins is also one important feature, which finally frees the author of new anti-debugging tools to concentrate on the logic of the test without having to spend a single second on its user's interface. Do you think your Olly is well hidden? Try this tool from Olly and all the possible hiding tools around, up to today there's always one test which detects Olly! Version 1.3 includes several plugins contributed by different authors as well as sources of sample plugins in Delphi, C, ASM. | |||
| Also listed in: | (Not listed in any other category) | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | Anti Olly Tester |
| ||
|---|---|---|---|---|
| Author: | Shub-nigurrath | |||
| Website: | http://arteam.accessroot.com/releases/ | |||
| Current version: | 1.0 | |||
| Last updated: | August 25, 2006 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free | |||
| Description: | This little program is more a POC than a friendly program. It's based on an idea Gabri3l discussed once, to test the environment in which the program is going to run and adapt itself to the conditions it finds. Well this program is a set of tests performed on the processes running on the system. They are performed on several tools using blacklists but there's a special attention paid to OllyDbg. Detects Debugging programs through different methods all connected to the execution environment. * Method 1: see if one of the currently running processes' Windows name is blacklisted or not * Method 2: Collects the ClassName of each of the active windows and check if it is blacklisted * Method 3: tests the processes paths and see if it is blacklisted * Method 4: tests modules (dll) loaded by any active process to see if any is a known plugin or matches a blacklistof process and words * Method 5: Opens the install folder where the program is running from and see if any of the files inside that folder has oneblacklisted word * Method 6: test export directory of the running processes, if there's something connected with Olly. * Method 7: test VERSION_INFO resource of the running processes to check if any matches a blacklist * Method 8: test all the other resources (dialog, menus, bitmaps and so on) of the running processes to check if any contains blacklisted words (either UNICODE or ASCII) The blacklists are taken from SDProtector and are generic enough to include almost all known RCE tool around. The result is really interesting and the resulting check is very difficult to overcome: It's very difficult to hide Olly to this type of tests. The final code is very small, even if written using C. Moreover consider that each test might be performed by parallel recurrent threads and decrypted/encrypted just before and after execution. An exe protected like this might easily become a nightmare, without having a to write a single ASM trick. Note that this same test is inside the distribution 1.2 of xADT into the test "Find Complex". | |||
| Also listed in: | (Not listed in any other category) | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
Feed containing all updates and additions for this category.
Feed containing all updates and additions for this category, including sub-categories.
