Identifying Anti-Debugging Techniques

When to Use

• A sample behaves differently (or exits) under a debugger and you need to find the checks.
• You are stuck at a point where execution diverges when analysis tooling is present.
• You want to neutralize anti-debug logic to continue dynamic analysis.

Do not use brute removal of every check — some are tied to control flow or decryption keys; faking the expected result is usually safer than deleting the check.

Prerequisites

• x64dbg (with anti-debug plugins like ScyllaHide) inside the victim VM.
• A disassembler to locate checks statically.
• Familiarity with the Windows PEB and debug APIs.

Workflow

Step 1: Enumerate likely checks statically

Scan imports and code for common anti-debug primitives:

python scripts/analyst.py scan sample.bin

API-based   : IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess
PEB-based   : BeingDebugged (PEB+0x2), NtGlobalFlag (PEB+0xBC/0x68)
Timing      : rdtsc, GetTickCount/QueryPerformanceCounter deltas around code
Exceptions  : INT3/INT2D, SetUnhandledExceptionFilter, single-step traps
Self-checks : CRC of own code, breakpoint (0xCC) scanning

Step 2: Confirm at runtime

Set breakpoints on the detection APIs and observe how the result is used (a conditional jump that leads to exit vs. real code).

Step 3: Neutralize

Prefer faking results over deletion: force IsDebuggerPresent to return 0, clear the PEB BeingDebugged flag, or use ScyllaHide to hook the common checks automatically. For timing, patch the comparison or reduce measured deltas.

Step 4: Re-run and continue

With checks neutralized, proceed to unpacking/behavior analysis. Re-scan in case later stages add more checks.

Validation

• After neutralization, execution follows the same path as on a non-debugged run.
• Faked check results do not break decryption or control flow (no corrupted code paths).
• The sample reaches and reveals its real behavior.

Pitfalls

• Patching a check that feeds a decryption key, corrupting later code. Understand the use before editing.
• Missing PEB-direct checks because you only looked at imported APIs.
• Stopping after one check; samples chain several across stages.

References

• See references/api-reference.md for the anti-debug scanner.
• Microsoft debug APIs and PEB documentation (linked in frontmatter).