1

How can I detect whether an application is using anti-debug techniques? I'm using OllyDbg (2.01beta).

3
  • Try to attach a debugger to the process of that application once it is active and see if it terminates right away.... that would be a start.
    – Till
    Sep 10, 2013 at 10:06
  • 1
    What kind of anti-debug technique ?
    – perror
    Sep 10, 2013 at 12:47
  • 1
    If it's closed-source, it's using an anti-debug technique. If it's not closed source, look at the source. Sep 10, 2013 at 20:01

1 Answer 1

3

Peter Ferrie has written a nice paper on this: The "Ultimate" Anti-Debugger Reference. A lot of techniques exist, like timing, checking if a process is running named OllyDBG for example. Sometimes people come up with new ideas. Step though your program and try to detect yourself if the program acts differently due to your debugging / olly or vmware (if this is the case).

2
  • This answer would be even more useful if you could add an abstract of the paper into it.
    – asheeshr
    Sep 11, 2013 at 2:03
  • The paper has a lot of code samples and how they work.
    – Stolas
    Sep 11, 2013 at 6:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.