Source Code for Module vtrace.tools.win32stealth

 1  '''
 
 2  Try to prevent an executable from knowing it's being debugged. 
 
 3  ''' 
 4  import vtrace 
 5  import vstruct 
 6  
 
 7 -class StealthBreak(vtrace.Breakpoint): 
 8      """
 
 9      A breakpoint to fake out CheckRemoteDebuggerPresent.
 
10      """ 
11 -    def notify(self, event, trace): 
12          sp = trace.getStackCounter() 
13          eip, handle, outbool = trace.readMemoryFormat(sp, "<LLL") 
14          trace.setRegisterByName("eax", 1) 
15          trace.writeMemoryFormat(outbool, "<L", 0) 
16          trace.setProgramCounter(eip) 
17          trace.setStackCounter(sp+12) 
18          trace.runAgain() 
19  
 
20 -def writeBeingDebugged(trace, val): 
21      peb = trace.parseExpression("peb") 
22      ps = vstruct.getStructure("win32.PEB") 
23      off = ps.vsGetOffset("BeingDebugged") 
24      trace.writeMemoryFormat(peb+off, "<B", val) 
25  
 
26 -def stealthify(trace): 
27  
 
28      writeBeingDebugged(trace, 0) 
29      sym = trace.getSymByName("kernel32").getSymByName("CheckRemoteDebuggerPresent") 
30      if sym != None: 
31          addr = long(sym) 
32          bp = StealthBreak(addr) 
33          bpid = trace.addBreakpoint(bp) 
34          trace.setMeta("Win32Stealth", bpid) 
35  
 
36 -def unstealthify(trace): 
37      writeBeingDebugged(trace, 1) 
38      bp = trace.getMeta("Win32Stealth") 
39      if bp != None: 
40          trace.setMeta("Win32Stealth", None) 
41          trace.removeBreakpoint(bp) 
42