Anti-debug techniques for MS-Windows?

Question

Is there any anti-debugger tricks used by malware other than interrupt INT 0x2D ? And, how do they work ? Working examples would be really nice !

Answer 1

@peter-ferrie compiled a very good list of anti-debugging tricks at http://pferrie.host22.com/papers/antidebug.pdf

The server for the link above seems to be down right now, but there's a copy at https://tuts4you.com/request.php?3260

Answer 2

Here is a good starting point on Windows anti-reverse engineering covers anti-debugging and much more: http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide

Since there are so many useful websites out there I'm going to link you to them instead of just telling you about tricks and how they work. If you do have any queries on how certain tricks work on anti-debugging feel free to ask.

Useful websites / Articles:

• http://www.openrce.org/reference_library/anti_reversing
• http://www.woodmann.com/collaborative/knowledge/index.php/Category:Anti_Reversing_Techniques
• http://www.symantec.com/connect/articles/windows-anti-debug-reference

That should be more than enough to get you going.

You could even go outside of the box and do API hooking on debugging APIs generally prefix with Dbg and located in EAT of NTDLL. There is plenty of APIs you could use.

Higher level API will be easy to bypass since they are generic across windows versions. For example IsDebuggerPresent and CheckRemoteDebuggerPresent are useless since everyone knows how easy it is to bypass in varies ways such as hooking and so on.

Here is useful website for all the internal APIs:

• http://undocumented.ntinternals.net/
• http://doxygen.reactos.org (Most of the APIs are accurate replicates of how Windows operates but not always the case)

So, when you hook the API let's pretend you're doing memory detour just set the trampoline to LdrShutdownProcess.