Skip to content

Latest commit

 

History

History

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 
 
 

README.md

Complexity Low

Description

NtGlobalFlag is a similar technique like IsDebuggerPresent, because both of them read values from PEB Structure to detect if the Software is debugged or not. NtGlobalFlag is also located in the PEB Structure, when the process is being debugged the NtGlobalFlag is set to 0x70.

Below picture from WinDBG is showing the PEB Structure when the Software is being debugged :

2

We developed our Software to show a error message then exit itself, whenever the NtGlobalFlag equal to 0x70 :

1

Reversing Technique (Tips & Tricks)

In order to evade this Anti Debugging technique, we can use a similar tactic just like on IsDebuggerPresent or we can hide our PEB Structure while debugging on x64DBG, I will show both of them

NULL the RAX :

After setting breakpoint at the return (ret) of the Anti debugging function, we can now step over to ret then change the RAX data to 0, this will evade the Anti Debugging technique which is same as like IsDebuggerPresent one

RAX

Change the value from RAX register (x64)

NULL

After the execution we can see it beat the Anti Debugging :

wİN

We can also able to automate this process by an awesome feature of x64DBG, it help us to hide our PEB Structure which means, debugged software no longer read data from PEB Animation