Reverse › Module 8 › Lesson 4
Lab — Anti-Analysis
Document anti-analysis on $RE_LAB sample — packer label, anti-debug rows, obfuscation pattern; recognize only, no commercial DRM bypass.
Visual · t23_anti_lab
Lab: anti-analysis recognition on $RE_LAB. Original Cyberlium.
Opening
Label what the binary did to hide — packer, ptrace, flattened graph — in notes blue and CTF readers can use.
On YOUR $RE_LAB CTF/crackme or malware-class lab sample per brief: (1) static pass — packer tool output, suspicious imports, entropy note; (2) dynamic pass — anti-debug trace rows (ptrace, timing, /proc); (3) Ghidra graph screenshot or description of obfuscation pattern if present; (4) anti-analysis summary table ≥6 rows: category, technique name, evidence, analyst action (documented); (5) explicit line: no commercial DRM bypass attempted; (6) chmod 600 pack. Brief may allow minimal CTF bypass on toy (e.g., LD_PRELOAD on YOUR crackme) — document only if authorized. No malware evasion tuning, no piracy unpack pipeline.
1. Summary table
Columns: Category (packer/anti-debug/obfuscation), Name, Static/Dynamic evidence, Action.
Link each row to Module 8 lessons and trace excerpt IDs.
Command guide
Try these commands — Summary table
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Anti-analysis lab — https://ghidra.re/ (strip + strings + gdb on YOUR toys) ptrace man — https://man7.org/linux/man-pages/man2/ptrace.2.html Binary Ninja — https://docs.binary.ninja/ (anti-debug pattern literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (binutils)
Command — copy this
sudo apt install gdb
macOS:
Command — copy this
brew install gdb
Windows: Use WSL or install binutils Use WSL gdb Use WSL or install file for Windows
═══ LINUX / macOS ═══
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
file "$LAB_RE/bin/"{antidebug,obfusc,check.stripped}
strings "$LAB_RE/bin/antidebug" | grep Debugger
strings "$LAB_RE/bin/obfusc" | head -8
gdb -q -batch -ex 'run' -ex quit "$LAB_RE/bin/antidebug" 2>&1 | grep -E 'Debugger|detected|No debugger' | head -3
echo 'anti lab: YOUR gcc toys only — never bypass protections on unauthorized software'Primary tools to practice this lesson: strings, gdb, file. Reference sites: Anti-analysis lab (https://ghidra.re/); ptrace man (https://man7.org/linux/man-pages/man2/ptrace.2.html); Binary Ninja (https://docs.binary.ninja/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Honest N/A
If sample has no packer, say N/A with evidence — do not invent anti-analysis.
Simple crackme may only have strcmp — valid finding.
3. Integrity
Recognition for CTF/malware class — refused commercial DRM strip.
Share redacted table only — no live malware casual upload.
4. What you ship: anti-analysis lab pack
Summary table ≥6 rows + static/dynamic evidence + no-DRM-bypass line — chmod 600.
5. What you record before the next lesson
Anti-analysis lab pack path.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Anti lab deliverable is unpacked commercial game for play.
Right
Anti-analysis lab pack documented on $RE_LAB. Next: quiz.
Mission: anti lab
1) Packer/static indicators. 2) Anti-debug trace rows. 3) Obfuscation note if any. 4) Summary table ≥6 rows; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Simple crackme — minimum rows?”
Knowledge Check
APPLY: Anti lab goal:
Multiple choice
Knowledge Check
APPLY: True or False: Unpack paid software for anti lab credit.
True or False
Knowledge Check
APPLY: Anti-analysis table includes:
Multiple choice