kamaal44 / antidebugging Goto Github PK

When developing software, it's sometimes necessary to thwart attempts to reverse engineer your program. While reverse engineering software, it's common to run across code that attempts you from reversing.

This repository hosts code that shows some fairly basic ways that developers can check for attached debuggers. If you're a reverse engineer, these are thing things that you'll need to bypass.

At this point, there are fairly standard techniques for trying to prevent reverse engineering. There are books on it, many pdfs, research articles, and even entire websites that go in-depth into each method. This is in no way an exhaustive list, but may be worth a star if you are learning about this area and want additional code to reference.

Also note that I don't describe how the methods actually work. As mentioned, this has been done a bazillion times by a bazillion people. At the end of this page I have links to other resources that describe them in detail.

Checking Your Own Process

IsDebuggerPresent - Most basic check

OutputDebugString - Attempt to communicate with an attached debugger

FindWindow - Search for debugger windows

ReadTEB - Internals of IsDebuggerPresent

NtCreateThreadEx - Run your code in another thread with debugging disables

Checking Other Processes

CheckRemoteDebuggerPresent - IsDebuggerPresent for external processes

References and Other Repositories

Great guide to how these work and how to bypass them

Scholarly paper on additional techniques