Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Anti-Debugging Check - Known Window Names #193

Open
recvfrom opened this issue Sep 13, 2019 · 1 comment
Open

Anti-Debugging Check - Known Window Names #193

recvfrom opened this issue Sep 13, 2019 · 1 comment

Comments

@recvfrom
Copy link
Contributor

recvfrom commented Sep 13, 2019

It'd be cool to make calls to FindWindow and look for window names associated with debuggers.

From [1]:

OLLYDBG
WinDbgFrameClass
Zeta Debugger
Rock Debugger
ObsidianGUI

From [2] (not including ones mentioned above):

icu_dbg
pe-diy
TDeDeMainForm
TIdaWindow

From [3], used by [4]:

GBDYLLO
pediy06
FilemonClass
File Monitor - Sysinternals: www.sysinternals.com
PROCMON_WINDOW_CLASS
Process Monitor - Sysinternals: www.sysinternals.com
RegmonClass
Registry Monitor - Sysinternals: www.sysinternals.com
18467-41

[1] https://cofense.com/satan/
[2] https://github.com/3val/Athena/blob/master/Source%20-%20Bot/Source/Protection/AntiDebugEmulate.cpp
[3] https://github.com/ctxis/CAPE/blob/master/modules/signatures/packer_themida.py
[4] https://www.virustotal.com/gui/file/8501700fc094ff0e48ad59f27a034580574b0d11a54eae7aceab65694a99a478/behavior/VirusTotal%20Cuckoofork

@lupier
Copy link

lupier commented Sep 14, 2019

This stuff is useless and not widely used in real life.
-Zeta Debugger
-Rock Debugger
-ObsidianGUI
-TDeDeMainForm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants