This paper classifies and presents several anti-debugging techniques used on Windows NT-based operating systems. Anti-debugging techniques are ways for a program to detect if it runs under control of a debugger. They are used by commercial executable protectors, packers and malicious software, to prevent or slow-down the process of reverse-engineering. We'll suppose the program is analyzed under a ring3 debugger, such as OllyDbg on Windows platforms. The paper is aimed towards reverse-engineers and malware analysts. Note that we will talk purely about generic anti-debugging and anti-tracing techniques. Specific debugger detection, such as window or processes enumeration, registry scanning, etc. will not be addressed here.
Expand all |
Post comment
How about using references ? a lot of tricks were introduced by protection systems years ago, and/or have been published in papers, websites etc.
And regarding your RDTSC checks , you should use cpuid before the rdtsc (or other serializing instructions , in order to prevent false positives on recent cpu (Out of order execution etc)
You can have a look into intel documentation..
[ reply ]
Link to this comment: http://www.securityfocus.com/comments/infocus/1893/958#958