SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
identifying-anti-debugging-techniques
0
Identifies and bypasses anti-debugging and anti-analysis checks in malware: PEB flags, debugger-detection APIs, timing checks, and exception tricks, then neutralizes them to continue analysis. Activates for requests to identify anti-debugging, bypass anti-debug checks, or analyze evasion that blocks a debugger.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Identifying Anti-Debugging Techniques ## When to Use - A sample behaves differently (or exits) under a debugger and you need to find the checks. - You are stuck at a point where execution diverges when analysis tooling is present. - You want to neutralize anti-debug logic to continue dynamic analysis. **Do not use** brute removal of every check — some are tied to control flow or decryption keys; faking the expected result is usually safer than deleting the check. ## Prerequisites - x64dbg (with anti-debug plugins like ScyllaHide) inside the victim VM. - A disassembler to locate checks statically. - Familiarity with the Windows PEB and debug APIs. ## Workflow ### Step 1: Enumerate likely checks statically Scan imports and code for common anti-debug primitives: ```bash python scripts/analyst.py scan sample.bin ``` ```text API-based : IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess PEB-based : BeingDebugged (PEB+0x2), NtGlobalFlag (PEB+0xBC/0x68) Timing : rdtsc, GetTickCount/QueryPerformanceCounter deltas around code Exceptions : INT3/INT2D, SetUnhandledExceptionFilter, single-step traps Self-checks : CRC of own code, breakpoint (0xCC) scanning ``` ### Step 2: Confirm at runtime Set breakpoints on the detection APIs and observe how the result is used (a conditional jump that leads to exit vs. real code). ### Step 3: Neutralize Prefer faking results over deletion: force `IsDebuggerPresent` to return 0, clear the PEB `BeingDebugged` flag, or use ScyllaHide to hook the common checks automatically. For timing, patch the comparison or reduce measured deltas. ### Step 4: Re-run and continue With checks neutralized, proceed to unpacking/behavior analysis. Re-scan in case later stages add more checks. ## Validation - After neutralization, execution follows the same path as on a non-debugged run. - Faked check results do not break decryption or control flow (no corrupted code paths). - The sample reaches and reveals its real behavior. ## Pitfalls - Patching a check that feeds a decryption key, corrupting later code. Understand the use before editing. - Missing PEB-direct checks because you only looked at imported APIs. - Stopping after one check; samples chain several across stages. ## References - See [`references/api-reference.md`](references/api-reference.md) for the anti-debug scanner. - Microsoft debug APIs and PEB documentation (linked in frontmatter).