# X64dbg Anti Debugger

> Anti-debugger techniques and bypass research in x64dbg workflows: PEB flags, NtQuery, object hides, timing, TLS, self-debug.

- Skill: `netvar1337/x64dbg-anti-debugger` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/x64dbg-anti-debugger`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/x64dbg-anti-debugger/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Research & Search
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/x64dbg-anti-debugger

---


# Anti-debugger (x64dbg workflow)

## Common checks
- PEB `BeingDebugged`, NtGlobalFlag, heap flags
- `NtQueryInformationProcess` (DebugPort, DebugObjectHandle, DebugFlags)
- `NtQuerySystemInformation` / handle table scans
- Parent process / window class heuristics
- RDTSC/QPC timing, trap flag, hardware BP detection
- TLS callbacks before entry

## RE procedure
1. Break early (system BP / TLS)
2. Patch or hide debug object as appropriate for lab
3. Prefer ScyllaHide-class plugins carefully — note detection of common hides
4. Log which check fired (don't blind-NOP everything)

## Pair with
`debugger`, `ida-reverse`, `anti-cheat-bypass`, `windows-internals`.

## Refs
- UC: x64dbg anti-debugger threads