How can I detect whether an application is using anti-debug techniques? I'm using OllyDbg (2.01beta).
-
Try to attach a debugger to the process of that application once it is active and see if it terminates right away.... that would be a start.– TillCommented Sep 10, 2013 at 10:06
-
1What kind of anti-debug technique ?– perrorCommented Sep 10, 2013 at 12:47
-
1If it's closed-source, it's using an anti-debug technique. If it's not closed source, look at the source.– Gilles 'SO- stop being evil'Commented Sep 10, 2013 at 20:01
Add a comment
|
1 Answer
Peter Ferrie has written a nice paper on this: The "Ultimate" Anti-Debugger Reference. A lot of techniques exist, like timing, checking if a process is running named OllyDBG for example. Sometimes people come up with new ideas. Step though your program and try to detect yourself if the program acts differently due to your debugging / olly or vmware (if this is the case).
-
This answer would be even more useful if you could add an abstract of the paper into it.– asheeshrCommented Sep 11, 2013 at 2:03
-