Cyberlium

Reverse › Module 8 › Lesson 2

BeginnerModule 8Lesson 2/5

Anti-Debug Named

Anti-debug literacy — ptrace, IsDebuggerPresent, timing checks, /proc reads; recognize and document on $RE_LAB, not evade EDR on stranger systems.

15 min+40 XP3 quiz
Module progress2 of 5

Visual · t23_anti_debug_named

Anti-debug = debugger detection named. Document on $RE_LAB. Original Cyberlium.

Opening

Anti-debug is the binary asking 'is someone watching?' — answer for your notes on CTF samples, not a recipe to hide malware from blue.

Anti-debug techniques detect analysis environments: ptrace(PTRACE_TRACEME), IsDebuggerPresent, CheckRemoteDebuggerPresent, timing rdtsc deltas, int 3 scanning, /proc/self/status TracerPid, parent process name checks, and breakpoint exception handling. Analyst literacy names the API or syscall, maps to static import or dynamic trace row, documents bypass category at CTF level only when brief allows on YOUR crackme — NOT tuning anti-debug against enterprise EDR, NOT hiding ransomware from sandboxes for crime, NOT helping commercial DRM evade security tools. strace/GDB from Module 6 often reveals ptrace early — log and label.

1. Named techniques

Linux: ptrace, prctl, read /proc/self/status. Windows: IsDebuggerPresent, NtQueryInformationProcess — name at literacy level.

Timing and exception-based checks — category names for report rows.

Command guide

Try these commands — Named techniques

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Anti-debug literacy — https://man7.org/linux/man-pages/man2/ptrace.2.html (ptrace concept) GDB anti-debug — https://sourceware.org/gdb/current/onlinedocs/gdb.html/ (defender/offense literacy) LiveOverflow — https://www.youtube.com/c/LiveOverflow (anti-analysis overview)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install build-essential
sudo apt install gdb

Built-in (binutils)

macOS:

Command — copy this

xcode-select --install  # or brew install gcc
brew install gdb

Windows: Use WSL or MinGW Use WSL gdb Use WSL or install binutils

═══ LINUX / macOS ═══

Optional command

sudo apt install build-essential gdb  # gcc gdb

Command — copy this

export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
cat > "$LAB_RE/src/antidebug.c" <<'EOF'
#include <stdio.h>
#include <sys/ptrace.h>
int main(void) {
    if (ptrace(PTRACE_TRACEME, 0, 0, 0) == -1) {
        puts("Debugger detected — educational anti-debug toy");
        return 1;
    }
    puts("No debugger — YOUR lab toy OK");
    return 0;
}
EOF

Command — copy this

gcc -Wall -O0 -g -o "$LAB_RE/bin/antidebug" "$LAB_RE/src/antidebug.c"
"$LAB_RE/bin/antidebug"
strings "$LAB_RE/bin/antidebug" | grep -E 'Debugger|No debugger'
gdb -q -batch -ex 'run' -ex quit "$LAB_RE/bin/antidebug" 2>&1 | head -8

Primary tools to practice this lesson: gcc, gdb, strings. Reference sites: Anti-debug literacy (https://man7.org/linux/man-pages/man2/ptrace.2.html); GDB anti-debug (https://sourceware.org/gdb/current/onlinedocs/gdb.html/); LiveOverflow (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Recognition workflow

Static: suspicious imports and strings 'debugger', 'gdb'. Dynamic: strace ptrace, GDB catch syscall.

Document: technique name, evidence row, analyst action (document only vs brief-approved CTF bypass on toy).

3. Refused use

Anti-anti-debug for malware distribution, evading $MAL_LAB/class sandbox for real attacks, commercial DRM evasion.

Cyberlium goal: defender and analyst recognition — purple detection ideas.

4. What you ship: anti-debug named card

Six technique names + static/dynamic recognition steps + document-not-weaponize line.

5. What you record before the next lesson

Anti-debug named card path.

6. Wrong vs right: commercial piracy vs crackmes/CTF toys

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

  • Wrong

    Implement anti-debug in malware sample for stranger distribution.

  • Right

    Anti-debug named card from $RE_LAB trace. Next: Obfuscation Named.

Mission: anti-debug named card

1) Name six anti-debug techniques. 2) Static import clues. 3) Dynamic trace clue example. 4) Write document-not-evade-for-crime line.

Stuck? Ask Cyberlium AI Mentor

Ask Mentor: “TracerPid row — where in /proc?”

Knowledge Check

1

APPLY: Anti-debug literacy means:

Multiple choice

Knowledge Check

2

APPLY: True or False: Anti-anti-debug for crime is course content.

True or False

Knowledge Check

3

APPLY: ptrace often appears in:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)