What are good Windows anti-debug references?

Asked Mar 29 '13 at 21:46

Active Mar 29 '13 at 22:20

Viewed 2,209 times

5

What are good anti-debug references for Windows which help with manual unpacking, emulating, or sandboxing?

edited Mar 29 '13 at 22:20

APerson

917
2
9
25

asked Mar 29 '13 at 21:46

Ange

6,694
3
28
62

Its great that you wrote this Q&A, but asking for references is not considered constructive. http://meta.stackexchange.com/questions/153220/why-is-asking-for-references-sources-to-study-specific-topics-considered-not-con even though it may be a self answered question. – asheeshr Mar 30 '13 at 01:53

1 Answers1

14

Peter Ferrie's “Ultimate” Anti-Debugging Reference (PDF, 147 pages) contains many anti-debugs, whether they're hardware or API based...
Walied Assar's blog shows his researches, which are focused on finding new anti-debugs.

other (maybe redundant) resources:

Nicolas Fallière's Windows Anti-Debug reference
OpenRCE's Anti Reverse Engineering Techniques Database
Daniel Plohmann's AntiRE
Rodrigo Branco's Scientific but Not Academical Overview of Malware Anti-Debugging, Anti-Disassembly and Anti- VM Technologies
Mark Vincent Yason's Art Of Unpacking

answered Mar 29 '13 at 21:46

Ange

6,694
3
28
62

This is a very good list. I included it in the anti-debug tag wiki, where this kind of information is better suited. – amccormack Mar 31 '13 at 04:29
I see - will do it next time. – Ange Apr 02 '13 at 14:01