GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → HackOvert → Antidbg

HackOvert / Antidbg

Licence: cc0-1.0
A bunch of Windows anti-debugging tricks for x86 and x64.

Labels

reverse-engineeringmalware-analysis

Projects that are alternatives of or similar to Antidbg

Matire
Malware Analysis, Threat Intelligence and Reverse Engineering: LABS
Stars: ✭ 55 (-68.93%)
Mutual labels:  malware-analysis, reverse-engineering
Sojobo
A binary analysis framework
Stars: ✭ 116 (-34.46%)
Mutual labels:  malware-analysis, reverse-engineering
Malware Analysis Scripts
Collection of scripts for different malware analysis tasks
Stars: ✭ 61 (-65.54%)
Mutual labels:  malware-analysis, reverse-engineering
Makin
makin - reveal anti-debugging and anti-VM tricks [This project is not maintained anymore]
Stars: ✭ 645 (+264.41%)
Mutual labels:  malware-analysis, reverse-engineering
Antidebugging
A collection of c++ programs that demonstrate common ways to detect the presence of an attached debugger.
Stars: ✭ 161 (-9.04%)
Mutual labels:  malware-analysis, reverse-engineering
Macbook issues
《macOS软件安全与逆向分析》勘误
Stars: ✭ 11 (-93.79%)
Mutual labels:  malware-analysis, reverse-engineering
Capa
The FLARE team's open-source tool to identify capabilities in executable files.
Stars: ✭ 1,981 (+1019.21%)
Mutual labels:  malware-analysis, reverse-engineering
Sec skills
软件安全工程师技能表
Stars: ✭ 410 (+131.64%)
Mutual labels:  malware-analysis, reverse-engineering
Awesome Csirt
Awesome CSIRT is an curated list of links and resources in security and CSIRT daily activities.
Stars: ✭ 132 (-25.42%)
Mutual labels:  malware-analysis, reverse-engineering
Mazewalker
Toolkit for enriching and speeding up static malware analysis
Stars: ✭ 132 (-25.42%)
Mutual labels:  malware-analysis, reverse-engineering
Apklab
Android Reverse-Engineering Workbench for VS Code
Stars: ✭ 470 (+165.54%)
Mutual labels:  malware-analysis, reverse-engineering
Nauz File Detector
Linker/Compiler/Tool detector for Windows, Linux and MacOS.
Stars: ✭ 146 (-17.51%)
Mutual labels:  malware-analysis, reverse-engineering
Stringsifter
A machine learning tool that ranks strings based on their relevance for malware analysis.
Stars: ✭ 469 (+164.97%)
Mutual labels:  malware-analysis, reverse-engineering
Pecli
CLI tool to analyze PE files
Stars: ✭ 46 (-74.01%)
Mutual labels:  malware-analysis, reverse-engineering
Pev
The PE file analysis toolkit
Stars: ✭ 422 (+138.42%)
Mutual labels:  malware-analysis, reverse-engineering
Fundamentos Engenharia Reversa
Livro: Fundamentos de Engenharia Reversa
Stars: ✭ 93 (-47.46%)
Mutual labels:  malware-analysis, reverse-engineering
Drakvuf Sandbox
DRAKVUF Sandbox - automated hypervisor-level malware analysis system
Stars: ✭ 384 (+116.95%)
Mutual labels:  malware-analysis, reverse-engineering
Dex Oracle
A pattern based Dalvik deobfuscator which uses limited execution to improve semantic analysis
Stars: ✭ 398 (+124.86%)
Mutual labels:  malware-analysis, reverse-engineering
Malwarelab vm Setup
Setup scripts for my Malware Analysis VMs
Stars: ✭ 126 (-28.81%)
Mutual labels:  malware-analysis, reverse-engineering
Pafish
Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do
Stars: ✭ 2,026 (+1044.63%)
Mutual labels:  reverse-engineering, malware-analysis
View All Similar Projects ➔

AntiDBG

AntiDBG is a collection of Windows Anti Debugging techniques. The techniques are categorized by the methods they use to find a debugger.

  • Memory
  • CPU
  • Timing
  • Forced Exceptions

Demos!

Want to see this stuff in action? Check out the playlist on YouTube.

AntiDBG API

AntiDBG is written in C and requires only a single source file and header. Nearly all of these methods are designed to take no input and produce no output. They aim to be self-contained debugger checks that will automatically detach debuggers.

Obfuscation

AntiDBG is designed to be readable so the user can learn about the techniques. If you choose to use these methods in your own project, you will benefit greatly by adding obfuscation on top of these methods. Obfuscation is not the aim of this project.

The Gauntlet

The Gauntlet is a simple application that runs each AntiDBG check one after the other. It's purpose is to test your ability to bypass the anti-debugging methods and make it to the end of The Gauntlet while running under a debugger.

Want to make The Gauntlet harder? Undefine SHOW_DEBUG_MESSAGES (defined by default in AntiDBG.cpp). This option produces a message box when you get caught with information about the check that got you.

FAQ & Troubleshooting

Help! X method doesn't seem to work.

Many anti-debugging checks focus on odd edge cases. Some require you to single step past, some require a specific debugger to be used, some require you to pass the exception to the debugger, etc.

All methods in AntiDBG have been tested under the conditions which they are designed work on Windows 10 64-bit. Most (if not all) should work on all other versions of Windows as well.

Help! This thing won't compile!

AntiDBG was developed and tested using Microsoft Visual Studio 2019. As long as you're using 2019, please submit an issue with details and I'd be happy to help.

Why is x86 assembly inline while x64 variants are in a .asm file?

Microsoft thought it would be a great idea to stop allowing developers to write inline assembly for x64. I don't know why, but the common reason I see cited around the internet is that developers suck at writing assembly and compilers are way better. While I don't disagree with this, I doubt that's the real reason. Whatever the reason, we now have to jump through hoops to do something even remotely similar. Huge thanks to lallouslab and onipot for guiding me through this minefield.

I have more questions.

I'd be happy to answer them! Please submit a GitHub issue with your questions and I'll try my best to help as soon as possible.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].