Reverse › Module 8 › Lesson 2
Anti-Debug Named
Anti-debug literacy — ptrace, IsDebuggerPresent, timing checks, /proc reads; recognize and document on $RE_LAB, not evade EDR on stranger systems.
Visual · t23_anti_debug_named
Anti-debug = debugger detection named. Document on $RE_LAB. Original Cyberlium.
Opening
Anti-debug is the binary asking 'is someone watching?' — answer for your notes on CTF samples, not a recipe to hide malware from blue.
Anti-debug techniques detect analysis environments: ptrace(PTRACE_TRACEME), IsDebuggerPresent, CheckRemoteDebuggerPresent, timing rdtsc deltas, int 3 scanning, /proc/self/status TracerPid, parent process name checks, and breakpoint exception handling. Analyst literacy names the API or syscall, maps to static import or dynamic trace row, documents bypass category at CTF level only when brief allows on YOUR crackme — NOT tuning anti-debug against enterprise EDR, NOT hiding ransomware from sandboxes for crime, NOT helping commercial DRM evade security tools. strace/GDB from Module 6 often reveals ptrace early — log and label.
1. Named techniques
Linux: ptrace, prctl, read /proc/self/status. Windows: IsDebuggerPresent, NtQueryInformationProcess — name at literacy level.
Timing and exception-based checks — category names for report rows.
Command guide
Try these commands — Named techniques
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Anti-debug literacy — https://man7.org/linux/man-pages/man2/ptrace.2.html (ptrace concept) GDB anti-debug — https://sourceware.org/gdb/current/onlinedocs/gdb.html/ (defender/offense literacy) LiveOverflow — https://www.youtube.com/c/LiveOverflow (anti-analysis overview)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential sudo apt install gdb
Built-in (binutils)
macOS:
Command — copy this
xcode-select --install # or brew install gcc brew install gdb
Windows: Use WSL or MinGW Use WSL gdb Use WSL or install binutils
═══ LINUX / macOS ═══
Optional command
sudo apt install build-essential gdb # gcc gdb
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
cat > "$LAB_RE/src/antidebug.c" <<'EOF'
#include <stdio.h>
#include <sys/ptrace.h>
int main(void) {
if (ptrace(PTRACE_TRACEME, 0, 0, 0) == -1) {
puts("Debugger detected — educational anti-debug toy");
return 1;
}
puts("No debugger — YOUR lab toy OK");
return 0;
}
EOFCommand — copy this
gcc -Wall -O0 -g -o "$LAB_RE/bin/antidebug" "$LAB_RE/src/antidebug.c" "$LAB_RE/bin/antidebug" strings "$LAB_RE/bin/antidebug" | grep -E 'Debugger|No debugger' gdb -q -batch -ex 'run' -ex quit "$LAB_RE/bin/antidebug" 2>&1 | head -8
Primary tools to practice this lesson: gcc, gdb, strings. Reference sites: Anti-debug literacy (https://man7.org/linux/man-pages/man2/ptrace.2.html); GDB anti-debug (https://sourceware.org/gdb/current/onlinedocs/gdb.html/); LiveOverflow (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Recognition workflow
Static: suspicious imports and strings 'debugger', 'gdb'. Dynamic: strace ptrace, GDB catch syscall.
Document: technique name, evidence row, analyst action (document only vs brief-approved CTF bypass on toy).
3. Refused use
Anti-anti-debug for malware distribution, evading $MAL_LAB/class sandbox for real attacks, commercial DRM evasion.
Cyberlium goal: defender and analyst recognition — purple detection ideas.
4. What you ship: anti-debug named card
Six technique names + static/dynamic recognition steps + document-not-weaponize line.
5. What you record before the next lesson
Anti-debug named card path.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Implement anti-debug in malware sample for stranger distribution.
Right
Anti-debug named card from $RE_LAB trace. Next: Obfuscation Named.
Mission: anti-debug named card
1) Name six anti-debug techniques. 2) Static import clues. 3) Dynamic trace clue example. 4) Write document-not-evade-for-crime line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “TracerPid row — where in /proc?”
Knowledge Check
APPLY: Anti-debug literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Anti-anti-debug for crime is course content.
True or False
Knowledge Check
APPLY: ptrace often appears in:
Multiple choice