A common anti-debugging practice is to overwrite functions such as DbgUiRemoteBreakin within ntdll.dll.

Since in-memory representation of common libraries is always the same on each platform, it should be possible for an external tool to connect to a process and compare in-memory library code with a reference in order to find any manipulations done by the process itself.

Does anybody know such a tool for Windows?


WinDbg can do this for Microsoft DLLs and executables (and generally for any code that can be obtained from the symbol server). Just attach the debugger to the process and do !chkimg <module>. It will download a clean copy of the module from the symbol server and compare it, reporting on differences.

This article has an example of the output you can expect to see when something has modified a binary.

  • The described manipulation is usually used for terminating the process when an debugger is attached. Therefore only the variant by analyzing a process memory dump would be possible. – Robert Jun 27 '13 at 15:49

You can attach to the process non invasive and use !chkimg !chkallimg !chksym commands.

Look for non invasive check box in the attach to process dialog in windbg or use .attach -v "pid"

Attaching in a non invasive way minimizes debugger interference and in most cases will not trigger the anti-debugging routines.

  • I was looking at your answers and saw that some of them were missing punctuation. I made some edits but in the future, please try to incorporate these into your answers as it makes them much more easier to read. Thanks! – asheeshr Jun 28 '13 at 2:50

Your Answer

