<commit_before>\newcommand{\sig}{\begin{flushright}\tiny{<NAME>, 2010, cc by 3.0}
 \url{http://corkami.googlecode.com/files/cm.pdf}\
 \href{https://corkami.googlecode.com/svn/trunk/misc/graphs/cm.tex}{source}\end{flushright}}
\newcommand{\ra}{$\rightarrow$\ }

\documentclass{report}
\usepackage{hyperref}
\usepackage[hmargin=1cm,vmargin=1cm]{geometry}
\usepackage{booktabs}	% better looking tables
\usepackage[table]{xcolor}
\rowcolors{0}{white}{lightgray}
\begin{document}
\begin{center} DRAFT Counter-measures (anti-debugs, \ldots) cheat sheet \end{center}

\begin{tabular}{lllll}
\toprule
name 			&  flags & description \\
\midrule
BeingDebugged		& {\tt D.....} & $ PEB.BeingDebugged $ db {\tt [fs:[30] + 2]} == 1\\
IsDbgPresent		& {\tt D....A} & $BeingDebugged$ check, via $IsDebuggerPresent$ \\
NtGlobalFlag			& {\tt D.....} & $ PEB.NtGlobalFlag $ dd {\tt [fs:[30] + 68]} has 70\footnotemark set \\
HeapFlags			& {\tt D.....} & $Heap.Flags$ dd {\tt [[fs:[30] + 18] + C] == 2} \\
ForceFlags			& {\tt D.....} & $Heap.ForceFlags$ dd {\tt  [[fs:[30] + 18] + 10]} is not null \\
msvcrt!trigo			& {\tt D....A} & $msvcrt!\_CIasin(invalid) \rightarrow$ {\tt al = NtGlobalFlag ?\ a8 :\ 98} \\
deletefiber			& {\tt D....A} & $DeleteFiber(invalid)$ $\rightarrow$ {\tt LastError = ForceFlags ?\ 80000003 :\ 57}\\
\href{http://corkami.blogspot.com/2010/01/hen-never-laid-and-corn-never-growed.html}
{gs} 				& {\tt .SE...} & {\tt GS} is reset, on thread switch \\
pop ss			& {\tt .S....} & debuggers can't step right after {\tt pop SS} $\rightarrow$ {\tt TF} set in {\tt EFlags}, {\tt 100} via {\tt pushf} \\
\href{http://corkami.blogspot.com/2010/01/policeman-got-no-gun-u-dont-have-2-run.html}
{smsw} 			& {\tt .SE...} & $operand$ = just after FPU {\tt ?\ 80010031 :\ 8001003b} \\
% disabled - can't reproduce
%\href{http://corkami.blogspot.com/2010/03/si-cest-ton-corps-qui-bouge-cest-ton.html}
%{f(n)stenv} 			& {\tt .S.I} & gets {\tt EIP} of last FPU instruction + stepping can loose the value\\
\href{http://corkami.blogspot.com/2010/03/si-cest-ton-corps-qui-bouge-cest-ton.html}
{int 2c/2e} 			& {\tt .SEI..} & slides over next instruction + sets {\tt EDX} to next {\tt EIP}, but incorrect if stepped\\
\href{http://corkami.blogspot.com/2010/02/and-when-i-start-to-come-undone-stitch.html}
{int 2d}			& {\tt D...X.} & triggers $BREAKPOINT$ exception if not under a debugger\\
\href{http://corkami.blogspot.com/2010/02/and-when-i-start-to-come-undone-stitch.html}
{InvalidHandle}		& {\tt D...XA} & $CloseHandle(invalid) \rightarrow$ {\tt INVALID HANDLE} exception if debugger is present\\
ChkRemoteDbg		& {\tt D....A} & {\small $CheckRemoteDebuggerPresent$}$(${\small $GetCurrentProcess()\footnotemark$}$, \&result)$ = 1 :\ 0\\
NtQueryInfo			& {\tt D....A} & {\small $NtQueryInformationProcess$}$(-1,$ {\small $ProcessDebugPort =$}$ 7, var, .....)$ \ra $[var] = present ? -1:0$ \\
HideThread			& {\tt D....A} & {\small $NtSetInformationThread$}$(-2, ${\small $ThreadhideFromDebugger$}$ = 11, -1, 0)$ \ra not responding \\
csr				& {\tt D....A} & {\small $OpenProcess$}$(\ldots, 0, ${\small $CsrGetProcessId$\footnotemark}$())$ \ra no error if {\small SeDebugPrivilege} acquired \\
Timing			& {\tt .S....} & comparison of two $RDTSC$, inlined $GetTickCount$\footnotemark, {\tt GS} resets, \ldots\\
Timing API			& {\tt .S...A} & comparison of two APIs like {\small $GetTickCount, GetSystemTime, QueryPerformanceCounter$}, \ldots \rowcolors{0}{white}{lightgray}
\\
\midrule
\multicolumn{3}{l}{Exceptions tricks (in the exception handler)} \\
\midrule
jmp				& {\tt ....X.} & change resume address via $Context.regEIP$ (Context{\tt +B8})\\
step				& {\tt ....X.} & step next instruction and re-trigger via setting $TF$ in $Context.EFlags$ (Context{\tt +C0})\\
hwbp				& {\tt ....X.} & set or detects hardware breakpoint via $Context.dr*$ (Context{\tt +04/+18})\\
higher			& {\tt ....X.} & overwrite higher handler and trigger exception ({\tt [esp+18]})\\
return				& {\tt ....X.} & overwrite return address in stack \ra context re-loading is skipped ({\tt [esp+24]}) \rowcolors{0}{white}{lightgray}
\\
\midrule
\multicolumn{3}{l}{Ollydbg (1.1) specific} \\
\midrule
esi				& {\tt D.....} & esi = -1 on startup under ollydbg, not in general \\
FPU				& {\tt D.....} & Display {\tt FFFFFFFF FFFFFFFF C0/40 3D} as float $\rightarrow$ crash \\
OdbgStr			& {\tt D....A} & $OutputDebugStringA("\%s\%s") \rightarrow$ crash \rowcolors{0}{white}{lightgray}
\\ 
\midrule
VmWare specific \\
\midrule
backdoor			& {\tt D.....} & {\tt in 'VMXh', 'VX'} $\rightarrow$ exception if not present, else modified {\tt eax} and {\tt ebx} \\
sidt				& {\tt D.....} & {\tt [operand + 5] == e8} or {\tt ff} if present \\
sldt				& {\tt D.....} & {\tt result != 0} if present \\
str				& {\tt D.....} & {\tt result == 4000h} if present \rowcolors{0}{white}{lightgray}
\\
\bottomrule
\end{tabular}

\sig

\newpage

{\large Flags}
\begin{itemize}
\item {\bf anti $D$ebugger}
detects if debugger is attached, or if specific tool is used
\item {\bf anti $S$tepping}
detects the program is not running (ex, not at full speed)
\item {\bf anti $E$mulator}
detects the program is running under an emulator - via a non documented or complex behavior
\item {\bf get e$I$p}
provides a way to retrieve current EIP
\item {\bf e$X$ception based}
relies on exceptions (Vectored, Structured, Unhandled filter)
\item {\bf $A$pi-based}
relies on an API call
\end{itemize}


{\large Reminders}
\begin{itemize}
\item
TF is used by a debugger for stepping: set TF, an exception will be triggered after next execution is stepped
\item
TEB is at {\tt fs:[18]}
\item
the PEB is accessible directly ({\tt fs:[30]}) or via $TEB.EnvironmentPointer$ ({\tt [fs:[18] + 30]})
\item
$LastError$ is accessible via $TEB.LastErrorValue$ ({\tt [fs:[18] + 34]}) $\rightarrow GetLastError$ is inlinable
\end{itemize}

{\large Notes}
\begin{enumerate}
\item
$70 = ${\footnotesize $FLG\_HEAP\_ENABLE\_TAIL\_CHECK$} $|$ {\footnotesize $FLG\_HEAP\_ENABLE\_FREE\_CHECK$} $|$ {\footnotesize  $FLG\_HEAP\_VALIDATE\_PARAMETERS$}
\item
FFFFFFFF (constant value)
\item
$dword[$7C980380$]$ (inlineable)
\item
$dword [$7FFE0000$] * dword[$7FFE0004$]) >> 24$ (inlineable)
\end{enumerate}
\sig
\end{document}
<commit_msg>removed draft - it's just in progress<commit_after>\newcommand{\sig}{\begin{flushright}\tiny{<NAME>, 2010, cc by 3.0}
 \url{http://corkami.googlecode.com/files/cm.pdf}\
 \href{https://corkami.googlecode.com/svn/trunk/misc/graphs/cm.tex}{source}\end{flushright}}
\newcommand{\ra}{$\rightarrow$\ }

\documentclass{report}
\usepackage{hyperref}
\usepackage[hmargin=1cm,vmargin=1cm]{geometry}
\usepackage{booktabs}	% better looking tables
\usepackage[table]{xcolor}
\rowcolors{0}{white}{lightgray}
\begin{document}
\begin{center}Counter-measures (anti-debugs, \ldots) cheat sheet \end{center}

\begin{tabular}{lllll}
\toprule
name 			&  flags & description \\
\midrule
BeingDebugged		& {\tt D.....} & $ PEB.BeingDebugged $ db {\tt [fs:[30] + 2]} == 1\\
IsDbgPresent		& {\tt D....A} & $BeingDebugged$ check, via $IsDebuggerPresent$ \\
NtGlobalFlag			& {\tt D.....} & $ PEB.NtGlobalFlag $ dd {\tt [fs:[30] + 68]} has 70\footnotemark set \\
HeapFlags			& {\tt D.....} & $Heap.Flags$ dd {\tt [[fs:[30] + 18] + C] == 2} \\
ForceFlags			& {\tt D.....} & $Heap.ForceFlags$ dd {\tt  [[fs:[30] + 18] + 10]} is not null \\
msvcrt!trigo			& {\tt D....A} & $msvcrt!\_CIasin(invalid) \rightarrow$ {\tt al = NtGlobalFlag ?\ a8 :\ 98} \\
deletefiber			& {\tt D....A} & $DeleteFiber(invalid)$ $\rightarrow$ {\tt LastError = ForceFlags ?\ 80000003 :\ 57}\\
\href{http://corkami.blogspot.com/2010/01/hen-never-laid-and-corn-never-growed.html}
{gs} 				& {\tt .SE...} & {\tt GS} is reset, on thread switch \\
pop ss			& {\tt .S....} & debuggers can't step right after {\tt pop SS} $\rightarrow$ {\tt TF} set in {\tt EFlags}, {\tt 100} via {\tt pushf} \\
\href{http://corkami.blogspot.com/2010/01/policeman-got-no-gun-u-dont-have-2-run.html}
{smsw} 			& {\tt .SE...} & $operand$ = just after FPU {\tt ?\ 80010031 :\ 8001003b} \\
% disabled - can't reproduce
%\href{http://corkami.blogspot.com/2010/03/si-cest-ton-corps-qui-bouge-cest-ton.html}
%{f(n)stenv} 			& {\tt .S.I} & gets {\tt EIP} of last FPU instruction + stepping can loose the value\\
\href{http://corkami.blogspot.com/2010/03/si-cest-ton-corps-qui-bouge-cest-ton.html}
{int 2c/2e} 			& {\tt .SEI..} & slides over next instruction + sets {\tt EDX} to next {\tt EIP}, but incorrect if stepped\\
\href{http://corkami.blogspot.com/2010/02/and-when-i-start-to-come-undone-stitch.html}
{int 2d}			& {\tt D...X.} & triggers $BREAKPOINT$ exception if not under a debugger\\
\href{http://corkami.blogspot.com/2010/02/and-when-i-start-to-come-undone-stitch.html}
{InvalidHandle}		& {\tt D...XA} & $CloseHandle(invalid) \rightarrow$ {\tt INVALID HANDLE} exception if debugger is present\\
ChkRemoteDbg		& {\tt D....A} & {\small $CheckRemoteDebuggerPresent$}$(${\small $GetCurrentProcess()\footnotemark$}$, \&result)$ = 1 :\ 0\\
NtQueryInfo			& {\tt D....A} & {\small $NtQueryInformationProcess$}$(-1,$ {\small $ProcessDebugPort =$}$ 7, var, .....)$ \ra $[var] = present ? -1:0$ \\
HideThread			& {\tt D....A} & {\small $NtSetInformationThread$}$(-2, ${\small $ThreadhideFromDebugger$}$ = 11, -1, 0)$ \ra not responding \\
csr				& {\tt D....A} & {\small $OpenProcess$}$(\ldots, 0, ${\small $CsrGetProcessId$\footnotemark}$())$ \ra no error if {\small SeDebugPrivilege} acquired \\
Timing			& {\tt .S....} & comparison of two $RDTSC$, inlined $GetTickCount$\footnotemark, {\tt GS} resets, \ldots\\
Timing API			& {\tt .S...A} & comparison of two APIs like {\small $GetTickCount, GetSystemTime, QueryPerformanceCounter$}, \ldots \rowcolors{0}{white}{lightgray}
\\
\midrule
\multicolumn{3}{l}{Exceptions tricks (in the exception handler)} \\
\midrule
jmp				& {\tt ....X.} & change resume address via $Context.regEIP$ (Context{\tt +B8})\\
step				& {\tt ....X.} & step next instruction and re-trigger via setting $TF$ in $Context.EFlags$ (Context{\tt +C0})\\
hwbp				& {\tt ....X.} & set or detects hardware breakpoint via $Context.dr*$ (Context{\tt +04/+18})\\
higher			& {\tt ....X.} & overwrite higher handler and trigger exception ({\tt [esp+18]})\\
return				& {\tt ....X.} & overwrite return address in stack \ra context re-loading is skipped ({\tt [esp+24]}) \rowcolors{0}{white}{lightgray}
\\
\midrule
\multicolumn{3}{l}{Ollydbg (1.1) specific} \\
\midrule
esi				& {\tt D.....} & esi = -1 on startup under ollydbg, not in general \\
FPU				& {\tt D.....} & Display {\tt FFFFFFFF FFFFFFFF C0/40 3D} as float $\rightarrow$ crash \\
OdbgStr			& {\tt D....A} & $OutputDebugStringA("\%s\%s") \rightarrow$ crash \rowcolors{0}{white}{lightgray}
\\ 
\midrule
VmWare specific \\
\midrule
backdoor			& {\tt D.....} & {\tt in 'VMXh', 'VX'} $\rightarrow$ exception if not present, else modified {\tt eax} and {\tt ebx} \\
sidt				& {\tt D.....} & {\tt [operand + 5] == e8} or {\tt ff} if present \\
sldt				& {\tt D.....} & {\tt result != 0} if present \\
str				& {\tt D.....} & {\tt result == 4000h} if present \rowcolors{0}{white}{lightgray}
\\
\bottomrule
\end{tabular}

\sig

\newpage

{\large Flags}
\begin{itemize}
\item {\bf anti $D$ebugger}
detects if debugger is attached, or if specific tool is used
\item {\bf anti $S$tepping}
detects the program is not running (ex, not at full speed)
\item {\bf anti $E$mulator}
detects the program is running under an emulator - via a non documented or complex behavior
\item {\bf get e$I$p}
provides a way to retrieve current EIP
\item {\bf e$X$ception based}
relies on exceptions (Vectored, Structured, Unhandled filter)
\item {\bf $A$pi-based}
relies on an API call
\end{itemize}


{\large Reminders}
\begin{itemize}
\item
TF is used by a debugger for stepping: set TF, an exception will be triggered after next execution is stepped
\item
TEB is at {\tt fs:[18]}
\item
the PEB is accessible directly ({\tt fs:[30]}) or via $TEB.EnvironmentPointer$ ({\tt [fs:[18] + 30]})
\item
$LastError$ is accessible via $TEB.LastErrorValue$ ({\tt [fs:[18] + 34]}) $\rightarrow GetLastError$ is inlinable
\end{itemize}

{\large Notes}
\begin{enumerate}
\item
$70 = ${\footnotesize $FLG\_HEAP\_ENABLE\_TAIL\_CHECK$} $|$ {\footnotesize $FLG\_HEAP\_ENABLE\_FREE\_CHECK$} $|$ {\footnotesize  $FLG\_HEAP\_VALIDATE\_PARAMETERS$}
\item
FFFFFFFF (constant value)
\item
$dword[$7C980380$]$ (inlineable)
\item
$dword [$7FFE0000$] * dword[$7FFE0004$]) >> 24$ (inlineable)
\end{enumerate}
\sig
\end{document}

{'fraction_non_alphanumeric': 0.1993245896489437, 'fraction_numerical': 0.02764470274090945, 'mean_word_length': 3.175081967213115, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 9, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 6, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '67122', 'n_tokens_mistral': 5133, 'n_tokens_neox': 4796, 'n_words': 1251}