Re:An Anti-Reverse Engineering Guide
by DrJokepu on Wednesday March 14, 2012 @06:35PM
(#3705782)
This is probably a very naive question but can't any of these measures be easily bypassed by running the observed software in a VM like KVM and just attaching a debugger like GDB directly to the VM?
[ Parent
| on HN ]
They absolutely can be. At the time this article was written (2008), VMs weren't as in vogue as they are today, VM-attached debugging wasn't as mature, and the leading "ring-0" / above-the-kernel debugger (SoftICE) had just been discontinued.
Today, there are a host of new measures designed to thwart in-VM debugging, but the playing field differs substantially from the one present when this article was written, and your observation is a good one.
What about the timer-based approach that he mentions? It seems that regardless of how you debug through a VM, it will still take additional time, unless you are altering the processor clock somehow.