Problem - Kevin Tafuro

int main(int argc, char *argv[ ]) {
if (spc_check_int3(myfunc_nodebug)) printf("being debugged: int3!\n");
return(0);
}
Checking for int3 opcodes is a crude and largely unreliable method. The comparison
with the 0xCC byte is immediately obvious when examining the disassembly of
the above source code:
8048328 :
8048328: push %ebp
8048329: mov %esp, %ebp
804832b: sub $4, %esp
804832e: mov 8(%ebp), %eax
8048331: mov (%eax), %al
8048333: cmp $0xCC, %al
8048335: jne 8048340
8048337: movl $1, -4(%ebp)
804833e: jmp 8048347
8048340: movl $0, -4(%ebp)
8048347: mov -4(%ebp), %eax
804834a: leave
804834b: ret
The compare instruction at address 8048333 is obviously checking for an embedded
int3 instruction. A software protection cracker can neutralize this check either by
changing the 0xCC byte in the compare instruction to another value (such as 0x90, the
nop instruction) or by changing the conditional jump instruction at address 8048335
(opcode 0x75) to an unconditional jump instruction (opcode 0xEB). In addition, most
modern debuggers support the use of the debug registers present in Intel x86 CPUs
because the Pentium breakpoints set using these registers do not require the int3
instruction and will not be detected with this method.
See Also
Recipes 12.13, 12.14, 12.15
12.13 Detecting Unix Debuggers
Problem
You need to prevent someone from debugging a Unix binary.
Solution
Single-stepping through code in a Unix environment causes a SIGTRAP to be sent to
the process. The debugger captures this signal and allows the user to examine the
state of the process before continuing execution. By installing a SIGTRAP handler and
sending itself a SIGTRAP, the process can determine whether it is being debugged.
682 | Chapter 12: Anti-Tampering
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.