CPR Anti-Debug Encyclopedia: The Check Point Anti-Debug Techniques Repository

guest · Aug 8, 2020

CPR Anti-Debug Encyclopedia: The Check Point Anti-Debug Techniques Repository
August 5, 2020
https://research.checkpoint.com/202...check-point-anti-debug-techniques-repository/

Debugging is the essential part of malware analysis. Every time we need to drill down into malware behavior, restore encryption methods or examine communication protocols – generally, whenever we need to examine memory at a certain moment of time – we use debuggers.

Debuggers interfere with the debugged process in a way that usually produces side-effects. These side-effects are often used by malicious programs to verify if they are executed under debugging. In turn knowledge of anti-debug techniques helps us detect when the malware tries to prevent us from debugging it and mitigate the interference.
Click to expand...

This encyclopedia contains the description of anti-debug tricks which work on the latest Windows releases with the most popular debuggers (such as OllyDbg, WinDbg, x64dbg). Deprecated techniques (e.g. for SoftICE, etc.) are not included (despite all the love to SoftICE).

All the techniques which are described in this encyclopedia are implemented in our ShowStopper open-source project. The encyclopedia can help you to better understand how these techniques work or to assess debuggers and anti-anti-debug plugins.
Click to expand...

Anti-Debug Encyclopedia

Log in or Sign up

CPR Anti-Debug Encyclopedia: The Check Point Anti-Debug Techniques Repository

guest Guest

Log in or Sign up

CPR Anti-Debug Encyclopedia: The Check Point Anti-Debug Techniques Repository

guest Guest

Useful Searches