EventPairHandles
Created the Monday 18 March 2019. Updated 3 years, 6 months ago.
An EventPair Object is an event constructed by two _KEVENT structures which are conventionally named High and Low.
There is a relation between generic Event Objects and Debuggers because they must create a custom event called DebugEvent able to handle exceptions. Due to the presence of events owned by the Debugger, every information relative to the events of a normal process differs from a debugged process.
Technique Identifier
Technique Tag
Code Snippets
#define WIN32_LEAN_AND_MEAN
#include <stdio.h>
#include <iostream>
#include <stdlib.h>
#include <windows.h>
#include "defs.h"
#pragma comment(lib,"ntdll.lib")
#pragma comment(lib,"psapi.lib")
void QueryProcessHeapMethod(void)
{
PDEBUG_BUFFER buffer;
buffer = RtlCreateQueryDebugBuffer(0,FALSE);
RtlQueryProcessHeapInformation(buffer);
if (buffer->RemoteSectionBase == (PVOID) 0x50000062){
MessageBoxA(NULL,"Debugged","Warning",MB_OK);
}
else {
MessageBoxA(NULL,"Not Debugged","Warning",MB_OK);
}
if (buffer->EventPairHandle == (PVOID) 0x00002b98) {
MessageBoxA(NULL,"Debugged","Warning",MB_OK);
}
else {
MessageBoxA(NULL,"Not Debugged","Warning",MB_OK);
printf("EventPairHandle= %x",(int)buffer->EventPairHandle);
}
}
int main()
{
QueryProcessHeapMethod();
return (EXIT_SUCCESS);
}Detection Rules
rule Detect_EventPairHandles: AntiDebug {
meta:
description = "Detect EventPairHandlesas anti-debug"
author = "Unprotect"
comment = "Experimental rule"
strings:
$1 = "EventPairHandles" fullword ascii
$2 = "RtlCreateQueryDebugBuffer" fullword ascii
$3 = "RtlQueryProcessHeapInformation" fullword ascii
condition:
uint16(0) == 0x5A4D and filesize < 1000KB and 2 of them
}