oalabs
patreon
Analyzing BlackMatter Anti-Debug With IDA Pro
🕑 Added 2021-10-15 17:00:15 +0000 UTCIn this tutorial we analyze the anti-debug checks in BlackMatter ransomware with IDA Pro. We use static analysis to determine exactly what the checks are doing.
BlackMatter sample:
Anti-debug feature explained:
Anti-Debug NtSetInformationThread
Comments
OALABS
I should have explained this better, there are some Windows tricks that are assumed with handles. Null for the main thread is translated into -2 for the current thread, or if a valid handle is passed in (not null) then they use the handle that was passed. In this case they are passing null that is translated into -2 for current thread. You can see the cast here in the POC code https://anti-debug.checkpoint.com/techniques/interactive.html#ntsetinformationthread
Y G
I'm not quite understand how the second anti-debug detects the debugger. From the code, seems it check the thread number whether it's 0(false), if not then hide the main thread from debugger. The question is, will the main thread number to be changed when the executable loaded by debugger?
