Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

What tricks can be used to prevent or hinder debugging?

Examples:

  • IsDebuggerPresent API on Windows
  • Exception handlers used for program flow.
  • GetTickCount / rdtsc checks.

Are there any good resources on this kind of thing?

share|improve this question
@AndrewSmith Care to substantiate your claims about banks using that technique? I've never heard of it. – Polynomial Aug 24 '12 at 5:56
1  
@Andrew - why write unsubstantiated and untrue nonsense? What makes you think any bank wants to obfuscate code and make their own debugging more difficult? – Rory Alsop♦ Aug 24 '12 at 6:58
Better one silly idea then none! – Andrew Smith Aug 24 '12 at 15:59
@AndrewSmith I cannot describe how fundamentally opposed I am to that sentiment. – Polynomial Aug 24 '12 at 16:01
I also cannot describe how well I do understand it too. – Andrew Smith Aug 24 '12 at 16:02

1 Answer

up vote 3 down vote accepted

You could begin looking at Symantec: http://www.symantec.com/connect/articles/windows-anti-debug-reference

And there is a question in Stackoverflow about anti-debugging tricks.

share|improve this answer
Figured someone would drop the Symantec paper on here at some point :) – Polynomial Aug 23 '12 at 19:42
:) think it's the only one I ever read about it... – woliveirajr Aug 23 '12 at 19:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.