GhostDebug

GhostDebug is a Windows x64 debugger prototype composed of a native debugging DLL and a .NET Framework command-line client. It is intended for debugging targets that use debugger-detection checks.

For background on the design, see Developing an undetected debugger on Windows.

Requirements

• Windows x64
• Visual Studio 2022 with the Desktop development with C++ workload
• Windows 10 SDK and the v143 C++ toolset
• .NET Framework 4.8 Developer Pack
• NuGet package restore enabled

Build

Build all projects in Visual Studio.

Usage

1. Start the target process. TestTarget is included as a simple example.

2. Open a terminal in GhostDebug/GhostDebug-CLI/bin/Release/ and start the CLI:

   root@kitploit:~

   .\GhostDebug.exe
   

3. Attach by process ID or process name, then use the interactive commands:

   root@kitploit:~

   attach <pid/process name>
      Attach to a process.
   
   bp <address>
      Set a breakpoint.
   
   bp <address> <command list>
      Set a breakpoint with commands that are executed automatically when it hits.
   
   cl <address>
      Clear a breakpoint.
   
   g
      Resume execution.
   
   t
      Step into one instruction.
   
   rw <register> <value>
      Queue a value to be written to a register before continuing.
   
   help
      Display the command help.
   

Addresses may be absolute, relative to the main module (+1234), relative to another module (ntdll+1234), or specified by symbol (!function or kernel32!ExitProcess). Breakpoints can also run commands automatically, for example bp 1234 rw rax 0;g.

The CLI must be run from the directory containing ghostdebug-core.dll, and the target and CLI should use the same architecture (x64).