About how to anti disable-debugger

hi ,man
i have written a driver for a few days, that is , there is a Game Protection(named TP,which developed by Tencent , China), it calls KdDisableDebugger to disable kernel debugger , added, that routine will be called when TP at stage of initialize , and then , it will create a thread to check the system variable KdDebuggerEnabled and call KdDisableDebugger in a loop while the variable is TRUE
also , there is a IAT HOOK, to instead address of KdSend/ReceivePacket with it’s own proxy routine

that’s a brief introduction all above , follow is my way to kill it
i write a driver , inline hook the KdDiableDebugger ,while this routine called by any driver at any where, i can get the caller address by _asm mov addr,dwrod ptr[ebp+4] , then i fill there with 0x90(NOP). by this way ,i killed two places of TP where it wanna call KdDisableDebugger. and i also killed the code of rebooting user’s PC in TP. finally , i hooked it’s proxy routine of KdSend/ReceivePacket by jumping to the exact address which export by kdcom.dll

but there is a problem, i run my driver after TP completely loaded , they both worked fine(i checked with windbg , perfect working),but i can’t set any breakpoint by windbg, so i check the variable KdDebuggerEnabled, it’s always FLASE and even i can’t change it’s value cuz my virtual machine will immediately stop while i modify it.
so i written a simple driver which function is calling KdEnableDebugger and printing the value of KdDebuggerEnabled , here is that
while(!(*KdDebuggerEnabled)) {
if(NT_SUCCESS(KdEnableDebugger())
KdPrint((“current status: value of KdDebuggerEnable is %s \n”,*KdDebuggerEnabled? “true”:“false”));
}
can you guess what result i got after i run my driver ? the code above will be executed for thousands of times , and the value of KdDebuggerEnabled still is FALSE

what should i do to solve this problem
looking forward to your reply and also sorry to my crappy engish , after all i am chinese and study at senior school, lol

Hold on.

What prevents your driver from being analyzed in Ida, and NOPing your hooks to KdSend/ReceivePacket in hiew, then loading patched driver onto machine for further analysys in WinDbg?

of course
i just used windbg and ida , here is the key , if i loaded the TesSafe.sys (the driver file of TP) with DriverMoniter ,there is no loop which detect and clear KdDebuggerEnabled

so , i.e i must kill that code , thus i can set KdDebuggerEnabled to 1 by calling KdEnabledDebugger routine

but KdDebuggerEnabled is a exported variable, and it will be accessed when system time update and something else , so VM will immediately BSOD when i set a break point on this variable

thanks for you reply~~~!

and hope who can tell me how to locate the address of that code that detect and clear KdDebuggerEnabled

Hacking and breaking protection will not be supported by this group.

Peter?

You can make your driver fail if the debugger is enabled, but even that
will cause you to be despised by the driver community, since there will
be no easy way to determine if your driver is the problem in a crashing
system.

Your idea of disabling the debugger is basically MALWARE. Even if you
can get it going it will not be stable, and can be caught by some virus
scanners. Besides which it can potentially open a legal situation where
you and your company can be sued.

Do not continue on your current path, and as Hagen indicated it is
doubtful anyone intelligent will help you mess up Windows.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

xxxxx@gmail.com” wrote in message
news:xxxxx@ntdev:

> of course
> i just used windbg and ida , here is the key , if i loaded the TesSafe.sys (the driver file of TP) with DriverMoniter ,there is no loop which detect and clear KdDebuggerEnabled
>
> so , i.e i must kill that code , thus i can set KdDebuggerEnabled to 1 by calling KdEnabledDebugger routine
>
> but KdDebuggerEnabled is a exported variable, and it will be accessed when system time update and something else , so VM will immediately BSOD when i set a break point on this variable
>
> thanks for you reply~~~!
>
> and hope who can tell me how to locate the address of that code that detect and clear KdDebuggerEnabled

Well in all fairness the OP is trying to hack another third party
piece of crap that is disabling the debugger by calling
KdDisableDebugger periodically. But I agree, a pox on both their
houses.

Mark Roddy

On Thu, Mar 10, 2011 at 8:53 AM, Don Burn wrote:
> You can make your driver fail if the debugger is enabled, but even that will
> cause you to be despised by the driver community, since there will be no
> easy way to determine if your driver is the problem in a crashing system.
>
> Your idea of disabling the debugger is basically MALWARE. ?Even if you can
> get it going it will not be stable, and can be caught by some virus
> scanners. ?Besides which it can potentially open a legal situation where you
> and your company can be sued.
>
> Do not continue on your current path, and as Hagen indicated it is doubtful
> anyone intelligent will help you mess up Windows.
>
>
> Don Burn (MVP, Windows DKD)
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
>
>
>
> “xxxxx@gmail.com” wrote in message
> news:xxxxx@ntdev:
>
>> of course
>> i just used windbg and ida , here is the key , if i loaded the TesSafe.sys
>> (the driver file of TP) with DriverMoniter ,there is no loop which detect
>> and clear KdDebuggerEnabled
>>
>> so , i.e i must kill that code , thus i can set KdDebuggerEnabled to 1 by
>> calling KdEnabledDebugger routine
>>
>> but KdDebuggerEnabled is a ?exported variable, and it will be accessed
>> when system time update and something else , so VM will ?immediately BSOD
>> when i set a break point on this variable
>>
>> thanks for you reply~~~!
>>
>> and hope who can tell me how to locate the address of that code that
>> detect and clear KdDebuggerEnabled
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

This group will not support hacking or other illegal activities… even if many of us DO think software like the OP wants to disable is a plague. It’s a slippery slope, and not one onto which we’re even going to venture.

This thread is locked and the OP has been put on permanent moderation – though I doubt he/she will want to post again.

Peter
OSR