How can I detect whether an application is using anti-debug techniques? I'm using OllyDbg (2.01beta).

  • Try to attach a debugger to the process of that application once it is active and see if it terminates right away.... that would be a start. – Till Sep 10 '13 at 10:06
  • 1
    What kind of anti-debug technique ? – perror Sep 10 '13 at 12:47
  • 1
    If it's closed-source, it's using an anti-debug technique. If it's not closed source, look at the source. – Gilles 'SO- stop being evil' Sep 10 '13 at 20:01

Peter Ferrie has written a nice paper on this: The "Ultimate" Anti-Debugger Reference. A lot of techniques exist, like timing, checking if a process is running named OllyDBG for example. Sometimes people come up with new ideas. Step though your program and try to detect yourself if the program acts differently due to your debugging / olly or vmware (if this is the case).

| improve this answer | |
  • This answer would be even more useful if you could add an abstract of the paper into it. – asheeshr Sep 11 '13 at 2:03
  • The paper has a lot of code samples and how they work. – Stolas Sep 11 '13 at 6:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.