I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more).
I am thinking about techniques such as the PTRACE
test at the beginning of a program (or at various points of its execution), the insertion of fake breakpoints (eg int3
/0xcc
x86 opcode) or time checks. But, also global strategies defined on the program to slow down the analysis of the program.
For now, all the techniques I found on Internet were easily worked around as soon as the anti-debug technique has been understood. So, I wonder if there are stronger ones.