Unseen Debugger Detection (Ollydbg)

[Shub-Nigurrath]

taos, effectively deepeer look revealed those strange things..any glue why?

I were also thinking a way to overcome the problem raised by the first post of this thread: how can I access that structure in a given process so as to proper values?

I mean, it's easily possible to patch the ZwQueryObject to return a null buffer and a null lenght, but it's not elegant. For example to avoid IsDebuggerPresent and similar checks, the most elegant way was to access the PEB block and change some values instead of patching the API.
Is such approach still doable with the OBJECT_ALL_TYPES_INFORMATION structure, where it is stored in a process?
I did some tests but were not able to find it or to find some specifications around.

Shub-Nigurrath, the information is actually gathered from kernel memory, at least its the case for DebugPort, only way to reset this is, by writing to kernel memory, which in some cases could be bad, take a look at:

http://illhostit.com/files/1787442368222872/Winject%201.5c%20(exe).rar

Last time i checked it was able to reset DebugPort from user mode, the way i think they are doing it is by getting the _EPROCESS struct for that particular process id, then doing some hacking to read/write to the memory of ->DebugPort and resetting it, which would be in kernel memory.

Atm iam solving with a kmd the DebugObject problem, but a usermode solution would be preferable.