6 ms·
Given the existence of Bochs, Qemu, and VMWare, the use of anti-debugger traps is a comical anachronism.
by asciilifeform 17y ago
Given the existence of Bochs, Qemu, and VMWare, the use of anti-debugger traps is a comical anachronism.
- tptacek 17y agoPer se, anti-debugger traps are an anachronism. In general, nothing about (say) Bochs obsoletes software protection. Advanced protected code (say) encrypts sensitive blocks, and uses (say) runtime artifacts to decrypt them before executing. There are software protection schemes that nobody has published breaks for, presumably because they are too much of a pain in the ass to break.
- mahmud 17y agoOff the top of your head, what are some hard ones to look at?
- tptacek 17y agoIf brl is watching, he'll name one that I decided was much too much of a pain in the ass to win a message board bet over. Most of my experience here is NDA'd though.
- Create 17y agoMost of my experience here is NDA'd though. ...security through obscurity never really works.
- tptacek 17y agoA nonstatement. Just because something is obscure doesn't mean that it hasn't also been secured. More importantly, in this setting, obscurity increases cost. DRM is all about cost.
- Create 17y agoA nonstatement. Just because something is obscure doesn't mean that it hasn't also been secured. A nonstatement. Just because something has also been secured, doesn't mean that it is secure. Obfuscation has no true correlation to true security.
- tptacek 17y agoI don't know who's argument that comment was intended to address, but it wasn't mine.
- vorador 17y agoNot necessarily. I'm sure that an emulator differs in some subtle ways from a real machine.
- asciilifeform 17y agoThe real question is, do all emulators differ in some consistent way from all "real" machines, and more so than "real" machines differ among themselves? The answer is almost certainly "no", and if it were "yes", the fix ought to be trivial, because there is no fundamental magic which emulators introduce and one might easily detect unspoofably.
- tptacek 17y agoYes. The predictable difference is timing.
- asciilifeform 17y agoHypothetically, software could be fed false outputs from timer-register reads in much the same way as it is fed false outputs from privileged instruction calls in VMWare. I am not aware of any publicly available emulator which does this, however. Alternatively, one could use automated means to find sections of a binary which behave in a logically distinct manner (branch differently in at least one place) when emulated instruction timings are twiddled. Then turn the disassembled section red in your debugger and attack it manually.
- vorador 17y agoThis paper may be of interest to you : http://handlers.sans.org/tliston/ThwartingVMDetection_Liston_Skoudis.pdf http://handlers.sans.org/tliston/ThwartingVMDetection_Liston...
- framiere 17y agoThanks for the paper, it was a nice read. I was stunned to see how straightforward it was. Basically by order of appearance you look for * well know files, or registry keys * patterns in a memory dump * use a great hack called "the red pill" using the SIDT instruction * vm specific hardwares * specific instructions/capabilities