A journey into anti-debugging

[@diegoporras7769]

How come this video doesn’t have thousands of views? This is gold man ❤ thanks

[@Trollicus]

Yo, I rewrote your self-debugging check in C# but I ran into a issue which you may have not, if you print anything before the check it'll print it twice because it opens 2nd process to do everything but I'm not entirely sure how to fix that so perhaps you know way lmk!

[@guilhemedemassenaladario]

That's are an amazing project that you're doing, thanks for sharing your knowledge.

[@phantomBTD]

And all the useful info !

[@phantomBTD]

Loved the video effects ! :D

[@fortniter6607]

thank you

[@RobertJohnson-lb3qz]

Looks like you have great content. Please dial up the volume some, can’t hear it...

[@SpooFaR]

AMAZING!!! GREAT!!!

[@s1dev]

can I use this with python? will I be able to attach gauntlet.cpp to my python file and then build it? I now use pyarmor to build my .py file to exe.

[@HackOvert]

I've never used pyarmor, but I have dabbled a bit with pyinstaller. I imagine it might be possible to create some kind of Frankenstein's monster of a binary that includes these anti debugging methods. The problem is that if I wanted to reverse engineer a py-exe, I'd dump the compiled python code segment and use a Python bytecode decompiler to get the original Python - I wouldn't even mess with debugging the py-exe file as a native binary. I think that would just add too much complexity. You'll have to dig into pyarmor's API and see if there's a way to include binary files. For example, with Pyinstaller, there is the ability to load shared objects/dlls and make calls from the loaded library: pyinstaller.readthedocs.io/en/stable/spec-files.html#adding-binary-files - this might be the most direct path.

[@s1dev]

Is there ways to include python in c/c# and the compile? in visual studio code.

[@HackOvert]

I don't have any experience doing that, but it looks like SWIG and Boost.Python are two options that might be viable. Check out this StackOverflow question and related answer for some leads: stackoverflow.com/questions/9117978/use-python-code-in-c-c Good luck!

[@s1dev]

@@HackOvert thanks, let me check that out. :)

[@diegoporras7769]

I’m assuming that if you don’t have the source code you’d do the same but patching the binary, right?

[@HackOvert]

Yep, exactly! Depending on what we're doing, we may either patch the binary, or write a debugger script to automate pausing the processes, modifying memory, and continuing execution rather than patching the binary itself. It's not too common, but software can hash code segments to verify instructions haven't been patched. So in certain cases patching instructions can bite you. I would only ever be cautious of that when dealing with malware that I know employs anti-debugging or I'm working on anti-tamper or DRM targets.

[@distortions]

where did you go @HackOvert