GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → CheckPointSW → Anti-Debug-DB

CheckPointSW / Anti-Debug-DB

Licence: MIT license
Anti-Debug encyclopedia contains methods used by malware to verify if they are executed under debugging. It includes the description of various anti-debug tricks, their implementation, and recommendations of how to mitigate the each trick.

Programming Languages

HTML
75241 projects
SCSS
7915 projects
javascript
184084 projects - #8 most used programming language

Labels

researchmalwareanti-debug

Projects that are alternatives of or similar to Anti-Debug-DB

showstopper
ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.
Stars: ✭ 132 (+560%)
Mutual labels:  research, malware, anti-debug
Invizzzible
InviZzzible is a tool for assessment of your virtual environments in an easy and reliable way. It contains the most recent and up to date detection and evasion techniques as well as fixes for them.
Stars: ✭ 268 (+1240%)
Mutual labels:  research, malware
Fidl
A sane API for IDA Pro's decompiler. Useful for malware RE and vulnerability research
Stars: ✭ 319 (+1495%)
Mutual labels:  research, malware
Whitecomet-Research
Research on malware creation and protection
Stars: ✭ 62 (+210%)
Mutual labels:  research, malware
Android unpacker
A (hopefully) generic unpacker for packed Android apps.
Stars: ✭ 320 (+1500%)
Mutual labels:  research, malware
FIDL
A sane API for IDA Pro's decompiler. Useful for malware RE and vulnerability research
Stars: ✭ 421 (+2005%)
Mutual labels:  research, malware
unprotect
Unprotect is a python tool for parsing PE malware and extract evasion techniques.
Stars: ✭ 75 (+275%)
Mutual labels:  malware, anti-debug
cerberus research
Research tools for analysing Cerberus banking trojan.
Stars: ✭ 110 (+450%)
Mutual labels:  research, malware
zotprime
Full packaged on-premise Zotero platform
Stars: ✭ 201 (+905%)
Mutual labels:  research
uplift
Compatibility layer for running Orbis executables natively on Windows.
Stars: ✭ 42 (+110%)
Mutual labels:  research
go-malware
Golang Virus Examples
Stars: ✭ 67 (+235%)
Mutual labels:  malware
antianalysis demos
Set of antianalysis techniques found in malware
Stars: ✭ 108 (+440%)
Mutual labels:  malware
impfuzzy
Fuzzy Hash calculated from import API of PE files
Stars: ✭ 67 (+235%)
Mutual labels:  malware
MsfMania
Python AV Evasion Tools
Stars: ✭ 388 (+1840%)
Mutual labels:  malware
mobileAudit
Django application that performs SAST and Malware Analysis for Android APKs
Stars: ✭ 140 (+600%)
Mutual labels:  malware
JavaRansomware
Simple Ransomware Tool in Pure Java
Stars: ✭ 99 (+395%)
Mutual labels:  malware
nozaki
HTTP fuzzer engine security oriented
Stars: ✭ 37 (+85%)
Mutual labels:  research
maalik
Feature-rich Post Exploitation Framework with Network Pivoting capabilities.
Stars: ✭ 75 (+275%)
Mutual labels:  malware
PyPackerDetect
A malware dataset curation tool which helps identify packed samples.
Stars: ✭ 27 (+35%)
Mutual labels:  malware
rkorova
ld_preload userland rootkit
Stars: ✭ 34 (+70%)
Mutual labels:  malware
View All Similar Projects ➔

Anti-Debug Tricks

Site

Compiled encyclopedia resides here: https://anti-debug.checkpoint.com.

Description

Debugging is the essential part of malware analysis. Every time we need to drill down into malware behavior, restore encryption methods or examine communication protocols – generally, whenever we need to examine memory at a certain moment of time – we use debuggers.

Debuggers interfere with the debugged process in a way that usually produces side-effects. These side-effects are often used by malicious programs to verify if they are executed under debugging. In turn knowledge of anti-debug techniques helps us detect when the malware tries to prevent us from debugging it and mitigate the interference.

This encyclopedia contains the description of anti-debug tricks which work on the latest Windows releases with the most popular debuggers (such as OllyDbg, WinDbg, x64dbg). Deprecated techniques (e.g. for SoftICE, etc.) are not included (despite all the love to SoftICE).

Anti-Debug tricks are grouped by the way in which they trigger side-effects (“meh, yet another classification”, you might think). Each group includes the description of corresponding tricks, their implementation in C/C++ or x86/x86-64 Assembly language, and recommendations of how to mitigate the trick for developers who want to create their own anti-anti-debug solution. In general, for bypassing anti-debug techniques we recommend using the ScyllaHide plugin which supports OllyDbg, x64dbg and IDA Pro.

All the techniques which are described in this encyclopedia are implemented in our ShowStopper open-source project. The encyclopedia can help you to better understand how these techniques work or to assess debuggers and anti-anti-debug plugins.

Yaraslau Harakhavik (@slevin_by),
Reverse Engineer at Check Point Research


References

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].