Cenega_anti_antidebugger.txt

//////////////////////////////////////////////////
//  FileName    :  Cenega_anti_antidebugger.txt
//  Comment     :  Defeats Cenega anti-debugging checks
//  Author      :  Luca91 (Luca1991) - Luca D'Amico
//  Date        :  2024-05-19
//  How to use  :  Load target exe and run this script.
//////////////////////////////////////////////////

// start
msg "Cenega anti antidebugger"
run // run til the EntryPoint

// clear breakpoints
bc
bphwc

// defeats isDebuggerPresent and manual PEB checks
$peb = peb()
set $peb+0x2, #00#

// find and hook NtQueryInformationProcess
nqip_addr = ntdll.dll:NtQueryInformationProcess
bp nqip_addr
SetBreakpointCommand nqip_addr, "scriptcmd call check_nqip"
erun
ret

check_nqip:
cmp [esp+8], 7 // 0x7 == ProcessDebugPort
je patch_process_information_buffer
cmp [esp+8], 0x1E // 0x1E == ProcessDebugObjectHandle
je patch_process_debug_object_handle
erun
ret

patch_process_information_buffer:
log "/!\ DEBUG CHECK FOUND (ProcessDebugPort): NtQueryInformationProcess({arg.get(0)}, {arg.get(1)}, {arg.get(2)}, {arg.get(3)}, {arg.get(4)})"
rtr
set [esp+C], #00 00 00 00#
erun
ret

patch_process_debug_object_handle:
log "/!\ DEBUG CHECK FOUND (ProcessDebugObjectHandle): NtQueryInformationProcess({arg.get(0)}, {arg.get(1)}, {arg.get(2)}, {arg.get(3)}, {arg.get(4)})"
rtr
set [esp+C], #00 00 00 00#
erun
ret