Is there any anti-debugger tricks used by malware other than interrupt
INT 0x2D ? And, how do they work ? Working examples would be really nice !
Here is a good starting point on Windows anti-reverse engineering covers anti-debugging and much more: http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide
Since there are so many useful websites out there I'm going to link you to them instead of just telling you about tricks and how they work. If you do have any queries on how certain tricks work on anti-debugging feel free to ask.
Useful websites / Articles:
That should be more than enough to get you going.
You could even go outside of the box and do API hooking on debugging APIs generally prefix with Dbg and located in EAT of NTDLL. There is plenty of APIs you could use.
Higher level API will be easy to bypass since they are generic across windows versions. For example
CheckRemoteDebuggerPresent are useless since everyone knows how easy it is to bypass in varies ways such as hooking and so on.
Here is useful website for all the internal APIs:
- http://doxygen.reactos.org (Most of the APIs are accurate replicates of how Windows operates but not always the case)
So, when you hook the API let's pretend you're doing memory detour just set the trampoline to