Hi, non technical reader.

Introduction

So basically this is the small program I wrote, which we are going to play with. In this program there are two functions : func1() and func2(). func1() is called from main, but func2() is never called.

So our aim is to execute func2 at run time.Here is the first run :

As you can see we do not go inside func2.

Reverse Engineering solution The first and the lot easier approach to this is, a RE solution. In this solution i just change some return addresses on the stack and we are done. Lets go step by step.

Step1 : Loading the program in OllyDbg

As can be seen there are three functions main, func1 and func2. These are indicated by the square brackets. The order of these functions is func1, func2 and lastly main.

Step2 : Now I am going to put a breakpoint on func1 and then observe the stack.

We have two images here the first one represents the assembly view of print2.cpp when i hitthe breakpoint and the second one represents the stack when I hit the breakpoint. In figure 1 it can be seen that the func1 starts at 401334 and it(the address) is in read with black background. Which indicates that we have hit the breakpoint. In figure two we can see that the return address for func1() is 0040139A. If we look up this address in the assembly dump, it is the one just after func1() is called that is 401395. Hence, things are fine here, the function always returns to the immediate expression after a call to it. So we have two deductions from here. First that the return address is 40139A which can be changed to make the func1() jump somewhere else. and secondly that this address is placed on the memory address starting 28FF0C.  

Step3 : Now we are going to edit 40139A to 401359 so that we can jump over to func2().

After the modification even the comment changes to print2.00401359, which suggests that it is call. And as expected we enter the func2().

However this is not enough. In a similar way we have to edit the return address of func2 to 40139A which was the original return address of func1. Now to be able to identify where is the return address of func2, we single step through func2 till we reach RETN.

Step4 : Here the top address on the stack is the return address for the stack. We need to change this address. In order to return and exit normally.

As can be seen on the stack 0028FF10 is the address where the return address 00403050 is stored. We modify this and then run the program.

We are able to do it neatly. :)

Program Solution

Now the RE solution was though easy, it wasn’t automated, and i had no fuckin idea about how do i make a permanent modification. What i mean here is like if you want to completely change an instruction you can do that and simply save changes to the new executable. But the stack is a dynamic memory region, it is not a part of the exe file that you save. So there was something more, some workaround that was needed. And thanks to Atul Alex Cherian, who told me about loader. So a loader is basically a program that lets the entire exe load in memory and then plays around with it. I first thought about using a tool for this, but then why not just code this shit out. So here is the algorithm that i followed for this.

Step1. Use fread to read the bytes of print2.exe to an array.

Step2. In this array modify the byte that represents beginning of func1 to CC (breakpoint).

Step3. Save this array to a new myf.exe

Step4. Detach pointer to myf.exe and open process myf.exe as a DEBUG_PROCESS

Step5. Waitforadebugevent and use a simple condition to check that it orignates from the one that you forced.

Step6. On receiving the EXCEPTION_BREAKPOINT DEBUG_EVENT suspend the thread using process information of myf.exe

Step7, Now change the CC that you placed to the original byte

Step8. Getthreadcontext of this thread and access the context structure to decrement EIP.

Step9. Now change return addresses of func1 and func2. For func1 only one byte is edited and for func2 one has to edit 2 bytes.

Step10. Resume thread. Myf.exe should exit after you press the first enter, then loader.exe should exit after you press the second enter. Here is the code :

Here is the screen shot showing its execution.

And special thanks to Dhanesh sir. :)

H3LL Y34H! :)

I am currently working on anti-debugging techniques which will also be my project for this year in college.Though i know for a fact  most basic anti-debug techniques are  API based techniques, but i am still doing this post because firstly i did not find any working code and whatever non-working code was present was also implemented locally… By the way I am really impressed by the work compiled by Tyler Shields in 2009 and he has put up some of the best resources out there!

This post is basically about one of those standard API’s > CheckRemoteDebuggerPresent function. Now there is enough stuff on msdn and other websites that you can find about its implementations and about the working of the function however for some reason they did not work for me! So here is what finally worked. And I have done a remote process example too.

Implementation for process locally 

#ifndef _WIN32_WINNT
#define _WIN32_WINNT 0x0601
#endif
#include<windows.h>
#include<stdio.h>
#include<conio.h>

int main()
{
BOOL pblsPresent = FALSE;
HANDLE hndle = NULL;

CheckRemoteDebuggerPresent(GetCurrentProcess(),&pblsPresent);
if(pblsPresent){
printf(“Being Debugged\n“);
}
else{
printf(“Not being debugged\n“);
}
getch();
return 0;
}

Implementation For Remote Process (with PID 2800)

#ifndef _WIN32_WINNT
#define _WIN32_WINNT 0x0601
#endif
#include<windows.h>
#include<stdio.h>
#include<conio.h>

int main()
{
BOOL pblsPresent = FALSE;
HANDLE hndle = NULL;

hndle=OpenProcess(PROCESS_ALL_ACCESS,FALSE,2800);

if(hndle){
printf(“Done getting a handle \n“);
}else {
printf(“Invalid PID \n“);
}
CheckRemoteDebuggerPresent(hndle,&pblsPresent);
if(pblsPresent){
printf(“Being Debugged\n“);
}
else{
printf(“Not being debugged\n“);
}
getch();
return 0;
}

Now I recently hacked one of my neighbor’s wifi and then scanned the network i found out that he was using a couple of devices… an Iphone(i came to know that it was an iphone during a conversation with my neighbor… as such the OS fingerprints were not detected on nmap.) …some nokia phone and a desktop….the desktop was a windows machine(with the ip 192.168.1.11) …windows xp sp2. But the problem was he had his firewall on … So one day he came online on facebook..so I asked him to switch off his firewall as that can create problems on a computer…and people tend to fall for things like this…so did he. :P

So the very next day I was online on facebook and i saw that he too was online at around 6:30 pm… so i quickly ran the metasploit loaded the exploit and attacked his machine… i did not expect that this would be successful but it was. :D  i had the meterpreter session running in less than a minute….i was in his machine with the power to do anything. :D
And just for fun i promptly sent a message box to his pc saying “You have been hacked”… aaaahhhh :( that was the mistake… this is the reason i am writing this post.. Whenever…mind my words WHENEVER…you hack something…stay silent dude :D ….

When he received this message box he came to know it was me… had a clue atleast(as he told the same later)… i quickly took screenshots of his desktop as is my habit.. then in around less than 5 second my phone was ringing and it was him calling :D Now that made me laugh! i was caught by the obvious proof!. so i had to tell him to switch on his firewall to stay protected.. But had i not sent that message box… and rather installed a telnet server on his computer and maintained a life long access to his pc… that would have been so much better… but aah! you learn from your mistakes… i learned to stay silent.

Now i cannot go into his pc anymore… there were millions of things i could have done…played around in so many ways if i had not made that mistake…. but never mind…mistake done…lesson learned.. :)