ADHD - Another Debugger Hiding Driver

This is a kernel driver that obscures some of the ways a debugger can be detected in Userland.

1. Resets PEB->BeingDebugged flag
2. Hooks ZwQueryInformationProcess to zero DebugPort
3. Protects DbgUiRemoteBreakin and DbgBreakpoint from modifications
4. Resets parent PID to explorer.exe
5. Blocks ZwSetInformationProcess(ThreadHideFromDebugger)

Stuff you still need to do:

1. Exception re-delivery. This is handled by good userland debuggers.
2. Hide your debugger process with FUTo.
3. Obfuscate your debugger's title with an injected DLL (Use CLU+Tron)
4. Software breakpoint scanning (Use CLU+Tron)
5. Wall clock time (script your debugger or use tracing)

www.openrce.org/downloads/download_file/233

| Сообщение посчитали полезным: