X64dbg Anti Debugger

Anti-debugger techniques and bypass research in x64dbg workflows: PEB flags, NtQuery, object hides, timing, TLS, self-debug.

netvar1337 5ebf95b 912 B Updated

File contents

Anti-debugger (x64dbg workflow)

Common checks

  • PEB BeingDebugged, NtGlobalFlag, heap flags
  • NtQueryInformationProcess (DebugPort, DebugObjectHandle, DebugFlags)
  • NtQuerySystemInformation / handle table scans
  • Parent process / window class heuristics
  • RDTSC/QPC timing, trap flag, hardware BP detection
  • TLS callbacks before entry

RE procedure

  1. Break early (system BP / TLS)
  2. Patch or hide debug object as appropriate for lab
  3. Prefer ScyllaHide-class plugins carefully — note detection of common hides
  4. Log which check fired (don't blind-NOP everything)

Pair with

debugger, ida-reverse, anti-cheat-bypass, windows-internals.

Refs

  • UC: x64dbg anti-debugger threads

netvar1337/unleash/tree/main/contrib/skills/x64dbg-anti-debugger commit 5ebf95b0e0

Frequently asked questions

npx skillmds@latest add netvar1337/x64dbg-anti-debugger