CPR Anti-Debug Encyclopedia: The Check Point Anti-Debug Techniques Repository
August 5, 2020
Debugging is the essential part of malware analysis. Every time we need to drill down into malware behavior, restore encryption methods or examine communication protocols – generally, whenever we need to examine memory at a certain moment of time – we use debuggers.
Debuggers interfere with the debugged process in a way that usually produces side-effects. These side-effects are often used by malicious programs to verify if they are executed under debugging. In turn knowledge of anti-debug techniques helps us detect when the malware tries to prevent us from debugging it and mitigate the interference.
This encyclopedia contains the description of anti-debug tricks which work on the latest Windows releases with the most popular debuggers (such as OllyDbg, WinDbg, x64dbg). Deprecated techniques (e.g. for SoftICE, etc.) are not included (despite all the love to SoftICE).
Anti-Debug tricks are grouped by the way in which they trigger side-effects (“meh, yet another classification”, you might think). Each group includes the description of corresponding tricks, their implementation in C/C++ or x86/x86-64 Assembly language, and recommendations of how to mitigate the trick for developers who want to create their own anti-anti-debug solution. In general, for bypassing anti-debug techniques we recommend using the ScyllaHide plugin which supports OllyDbg, x64dbg and IDA Pro.
All the techniques which are described in this encyclopedia are implemented in our ShowStopper open-source project. The encyclopedia can help you to better understand how these techniques work or to assess debuggers and anti-anti-debug plugins.
The following sources were used during the encyclopedia compilation and must get their credits:
- P. Ferrie. The “Ultimate”Anti-Debugging Reference
- N. Falliere. Windows Anti-Debug Reference
- J. Jackson. An Anti-Reverse Engineering Guide
- Anti Debugging Protection Techniques with Examples
- simpliFiRE.AntiRE
If you want to contribute to this encyclopedia, you’re more than welcome to create pull requests in its github.
Go to the Anti-Debug Encyclopedia
POPULAR POSTS
- Artificial Intelligence
- ChatGPT
- Check Point Research Publications
- Check Point Research Publications
- Threat Research
- Artificial Intelligence
- ChatGPT
- Check Point Research Publications
BLOGS AND PUBLICATIONS
- Check Point Research Publications
- Global Cyber Attack Reports
- Threat Research
February 17, 2020
“The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign
- Check Point Research Publications
August 11, 2017
“The Next WannaCry” Vulnerability is Here
- Check Point Research Publications
January 11, 2018