Note that we will talk purely about generic anti-debugging and anti-tracing techniques. The paper is aimed towards reverse-engineers and malware analysts. We'll suppose the program is analyzed under a ring3 debugger, such as OllyDbg on Windows platforms. They are used by commercial executable protectors, packers and malicious software, to prevent or slow-down the process of reverse-engineering. This paper classifies and presents several anti-debugging techniques used on Windows NT-based operating systems.Īnti-debugging techniques are ways for a program to detect if it runs under control of a debugger. Specific debugger detection, such as window or processes enumeration, registry scanning, etc. Anti-debugging techniques are ways for a program to detect if it runs under control of a debugger. This paper classifies and presents several anti-debugging techniques used on Windows NT-based operating systems.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |