When aadp fails about aadp

[GoogleCodeExporter]

I think this is not a defect in aadp, is could be an enhancement. First of all, 
aadp4olly does not support x64 platforms yet. Second, if the program is 
detecting the debugger, it could be for a antidbg trick that aadp4olly 
currently does not support, so, maybe you must fill a ticket with a description 
of the anti-dbg trick implemented by the application and we will add to the 
aadp4olly the corresponding anti-anti-dbg trick.

Would you provide a brief description of the anti-dbg tricks implemented by the 
program that is detecting the debugger?.

Original comment by [email protected] on 14 May 2011 at 4:52

• Added labels: Type-Enhancement
• Removed labels: Type-Defect

[GoogleCodeExporter]

Original comment by [email protected] on 14 May 2011 at 4:52

[GoogleCodeExporter]

What have x64 platforms to do with this ?
Did you even check the program _and_ the codec ?
graphstudio is 32 bit ! (I used graphstudio for easiest example of how to 
reproduce what the codec is doing.)
The codec is also 32-bit, it's the codec that have that nasty unfriendly 
anti-debugger crap. (That messes with me when i debug my video player)

What you need to do to not get detected:
1. Reset the debugger flag
2. Protect NtQueryInformationProcess.
Done.
(The codec use similar protection as xlive. Dynamically unpacked anti-debug 
code)

Yes this IS a defect because you already have both of those protections in the 
plugin.

One of them are not functioning correctly.

Tip: Perhaps you should protect the Nt* functions instead of the Zw*.

I'd be happy to help you test an updated version when ready.
I'm guessing you do not have windows 7 with the nasty buggy codec.

Original comment by [email protected] on 18 May 2011 at 1:40

Attachments:

• DEFECT.png

[GoogleCodeExporter]

i now graphstudio is 32 bits and the codec too, but, when you filled the 
ticket, you filled with this:

"""
On what operating system?
Windows 7 Ultimate(64-bit)
"""

The TEB and PEB structures in 32 bits process running in a WOW (x64 OS) 
sub-system are a little bit different. Try it in a 32 bits operative system and 
let me know if still fail, if so, then, i will check it.

Original comment by [email protected] on 18 May 2011 at 1:23

[GoogleCodeExporter]

I do not have a 32-bit os to test with.

But i can tell you that another plugin called Stealth64 do work.
It do have a x64 compatibility mode in the options but i did _not_ activate it.

Original comment by [email protected] on 19 May 2011 at 5:02

Attachments:

• Stealth64.png

[GoogleCodeExporter]

yes, that is because stealth64 has support for x64 OSes!. i was talking with 
the author of Stealth64, friend of mine, and he shared some code of his plugin 
to include in the next version of aadp. currently, we do not have support for 
x64 OSes, sorry.

You can fill a new ticket requesting this feature, but, anyways, is in our TODO 
list.

Original comment by [email protected] on 19 May 2011 at 1:18

[GoogleCodeExporter]

Do you mean the x64 support is always activated in stealth64 ?
Even when i unckeck the "x64 compatibility mode" ?

That's sort of strange.

Original comment by [email protected] on 19 May 2011 at 9:29

[GoogleCodeExporter]

no, the "x64 compatibility mode" is about the exceptions handling under WOW and 
Olly, but, the other Stealth64 tricks patch the right place in the PEB/TEB 
under x64 OSes, aadp does not have that (yet).

Original comment by [email protected] on 20 May 2011 at 2:22

[GoogleCodeExporter]

anyways, i'll try it under x64 and x32 OSes and let you know my results.

Original comment by [email protected] on 20 May 2011 at 2:26