Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

UNCLASSIFIED
Pique Proof-of-Concept (PoC) Report
Anti-Debugging and Anti-Emulation
(U) When tracing over the pop ss instruction in this example
code, the next instruction will be executed but the debugger
will not break on it, therefore stopping on the following
instruction, nop in this case. This rare anti-debugging trick
has been seen in the wild as follows:
(U) The trick here is that if the debugger is tracing over this sequence of instructions, popf will
be executed implicitly and the debugger will not be able to unset the trapflag. The malware
checks for the trapflag and debugger is present if found.
(U) Trolling the Debugger
(U) In addition to detecting the presence of a debugger and responding accordingly, by either
exiting without installing malicious code or by presenting benign behavior, some malware has
been observed interfering with debugger functionality to make a malware analyst’s job more
difficult. While we’re pretty certain the Sponsor would not use such tactics, we’re including
these techniques for completeness.
(U) Modifying the SEH Chain
(U) Modifying the SEH chain can be used as an anti-disassembly technique as well as an anti-
debugging technique. Exception-based detection relies on the fact that debuggers will trap the
exception and not immediately pass it to the process for handling. If the debugger fails to pass
the exception to the process for handling, as most will do, that can be detected within the
exception-handling mechanism and a determination that a debugger is running can be made.
(U) Inserting INT Commands
Raytheon Blackbird Technologies, Inc.
14
07 August 2015
Use or disclosure of data contained on this sheet is subject to the restrictions on the title page of this document.
UNCLASSIFIED
push ss
; junk code here
pop ss
pushf
; junk code here
pop eax
and eax,100h
or eax,eax

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh