Anti-debugger (x64dbg workflow)
Common checks
- PEB
BeingDebugged, NtGlobalFlag, heap flags NtQueryInformationProcess(DebugPort, DebugObjectHandle, DebugFlags)NtQuerySystemInformation/ handle table scans- Parent process / window class heuristics
- RDTSC/QPC timing, trap flag, hardware BP detection
- TLS callbacks before entry
RE procedure
- Break early (system BP / TLS)
- Patch or hide debug object as appropriate for lab
- Prefer ScyllaHide-class plugins carefully — note detection of common hides
- Log which check fired (don't blind-NOP everything)
Pair with
debugger, ida-reverse, anti-cheat-bypass, windows-internals.
Refs
- UC: x64dbg anti-debugger threads