Anti Debugging Techniques

Anti-Debugging Techniques

Upstream reference: yaklang/hack-skills/anti-debugging-techniques — distilled from ctf-wiki + hacktricks. Use that page for full prose. Language rule: instructions in English; final user-facing summary in Vietnamese.

0. Authorization & routing

Operates under MASTER_POLICY.md §1-§2 (owner-attested target, granted technical authority).

Run this skill before binary-patcher on any commercial-grade binary — patches misfire when anti-debug watchdogs are still live.

1. Detection-class → first-line bypass

2. Linux check signatures (grep-able)

ptrace(           # PTRACE_TRACEME self-attach
fopen("/proc/self/status"      # TracerPid scan
fopen("/proc/self/maps"        # Frida/LD_PRELOAD scan
rdtsc                          # timing measurement
signal(SIGTRAP                 # signal-swallowed test
fork()                         # potential watchdog parent/child

3. Windows PEB + Nt* offsets (x64)

NtQueryInformationProcess info-class IDs: ProcessDebugPort=0x07, ProcessDebugObjectHandle=0x1E, ProcessDebugFlags=0x1F (returns 0 when debugged — inverted).

4. Tooling matrix

5. Functional bypass snippets

Linux ptrace shim

# bash / WSL
cat > /tmp/ap.c <<'EOF'
long ptrace(int r, int p, void *a, void *d) { return 0; }
EOF
gcc -shared -fPIC -o /tmp/ap.so /tmp/ap.c
LD_PRELOAD=/tmp/ap.so ./target

GDB catch-and-clear

(gdb) catch syscall ptrace
(gdb) commands
> set $rax = 0
> continue
> end

Frida cross-platform

// Linux ptrace
Interceptor.replace(
  Module.getExportByName(null, 'ptrace'),
  new NativeCallback(() => 0, 'long', ['int', 'int', 'pointer', 'pointer'])
);
// Windows IsDebuggerPresent
Interceptor.replace(
  Module.getExportByName('kernel32.dll', 'IsDebuggerPresent'),
  new NativeCallback(() => 0, 'int', [])
);

x64dbg + ScyllaHide (PowerShell launch)

& 'C:\Tools\x64dbg\x64\x64dbg.exe' 'C:\Program Files\MyApp\target.exe'
# In GUI: Plugins → ScyllaHide → Options →
#   PEB BeingDebugged, NtGlobalFlag, HeapFlags
#   NtQueryInformationProcess (all classes)
#   NtSetInformationThread (HideFromDebugger)
#   GetTickCount, QueryPerformanceCounter
# → Apply → restart session

6. Bypass methodology

1. Static scan — grep the strings/imports above; map every check site.
2. Classify each hit into the table in §1.
3. Apply layered bypass — start with ScyllaHide (Win) or LD_PRELOAD shim (Linux); they cover ~80% of common checks.
4. Handle TLS callbacks before main runs (x64dbg "Break on TLS" / WinDbg sxe ld).
5. Verify — set BP on ExitProcess/exit/_exit; if hit unexpectedly, a check was missed → trace back.

7. Real-world protector defaults

8. Final report (Vietnamese)

🛡️ Bypass Anti-Debug hoàn tất:
  🔍 Phát hiện     : <DETECTION_TYPES>
  🛠️ Bypass        : <METHODS>
  🧰 Công cụ        : <ScyllaHide | Frida | LD_PRELOAD | GDB>
  ✅ Verify        : chạy không exit sớm dưới debugger

▶  Tiếp:
   binary-protection-bypass (nếu ASLR/PIE chặn patch)
   → binary-patcher (vá license check)