Home

Awesome

AADebug

内核反反调试插件 Kernel Anit-Anit-Debug Plugins

Language

English(Translation from https://github.com/finch7)

When debugging begins, a kernel object called “debug object” will be created

调试开始时,将创建一个称为“调试对象”的内核对象

通过重写 By rewrite

NtDebugActiveProcess DbgkpQueueMessage KiDispatchException DebugActiveProcess DbgUixxx

等函数绕过调试对象(Process->DebugObject)以及其他关键位置实现反反调试效果 such functions to bypass debugging object (Process->DebugObject)and other key locations to achiece anti-anti-debugging effects

目前已实现

Currently implemented

BUG

未来准备支持(按优先级排序)

Future support (in order of priority)

(Completed, some of the kernel projects are too big, it is better to do processing at the application layer, if the kernel does it, the gain is not worth the loss) bypass most al-khaser Application layer anti-debugging methods

Screenshot(2020-12-20)

从左到右依次为 From left to right

<h1 align="center"> <img src="1.png" > <br> <br> </h1>

Screenshot(2020-12-21)

<h1 align="center"> <img src="2.png" > <br> <br> </h1>

Screenshot(2020-12-23)

从左到右依次为 From left to right

<h1 align="center"> <img src="3.png" > <br> <br> </h1> <h1 align="center"> <img src="5.png" > <br> <br> </h1> <h1 align="center"> <img src="4.png" > <br> <br> </h1> <h1 align="center"> <img src="6.png" > <br> <br> </h1>

Screenshot(2020-12-27)

<h1 align="center"> <img src="8.png" > <br> <br> </h1> <h1 align="center"> <img src="7.png" > <br> <br> </h1>

Reference

https://github.com/MeeSong/KTL 启用内核STL Enable kernel STL

https://github.com/MeeSong/TrialSword (private project) 参考了不少该项目代码

https://github.com/matt-wu 部分代码被我放在了该项目中 不过那部分代码已经从公开库中删除

I put part of the code in the project, but that part of the code has been deleted from the public library

Build

为了避免一些不必要的麻烦 删除了内核钩子库部分代码 剩余部分已经补全

The anti-anti-debugging plug-in is special. In order to avoid some unnecessary troubles, some codes have been deleted (only less than 1% have been deleted

压缩包密码:

Release passwd

123 1234 123456 123456789 (我忘记具体是哪个了...)

内核交流小群(780705352)

注:仅供windows内核技术交流 邀请制或审核制入群 申请加群后 我会添加好友 麻烦各位通过好友请求并耐心等待审核