Anti-Debug Bypass Playbook

Malware and protected commercial software check for debuggers and sandboxes before running real logic. Bypassing these checks is required to dynamically analyze them. Each check has a known counter.

1. Enumerate anti-debug techniques in the binary

Static signature scan

# Windows API calls
strings /tmp/sample | grep -iE 'IsDebuggerPresent|NtQuery|CheckRemoteDebugger|OutputDebugString'

# Linux ptrace check
strings /tmp/sample | grep -iE 'ptrace|/proc/self/status|TracerPid'

# CPUID hypervisor check
strings /tmp/sample | grep -iE 'vmware|VirtualBox|qemu|xen'

# Detect via YARA rules
yara -r /opt/yara-rules/anti_debug.yar /tmp/sample

Decepticon helper:

bin_anti_debug_scan("/tmp/sample")

2. Common checks + bypasses

Windows checks

ScyllaHide (x64dbg/x32dbg/IDA plugin) handles essentially all of these automatically.

Linux checks

LD_PRELOAD bypass example

// bypass.c
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <sys/ptrace.h>
#include <string.h>

long ptrace(int request, int pid, void *addr, void *data) {
    return 0;  // pretend it always succeeds
}

FILE *fopen(const char *path, const char *mode) {
    static FILE *(*orig)(const char *, const char *) = NULL;
    if (!orig) orig = dlsym(RTLD_NEXT, "fopen");
    if (strstr(path, "/proc/self/status") || strstr(path, "/proc/self/stat")) {
        // Return a doctored file
        FILE *tmp = tmpfile();
        fprintf(tmp, "TracerPid:\t0\n");
        rewind(tmp);
        return tmp;
    }
    return orig(path, mode);
}

gcc -shared -fPIC bypass.c -o bypass.so -ldl
LD_PRELOAD=./bypass.so gdb /tmp/sample

3. Anti-VM / sandbox detection

4. Dynamic bypass via debugger

x64dbg / x32dbg (Windows)

1. Install ScyllaHide plugin
2. In the plugin, enable all checks (PEB patches, NtSetInformation hooks, etc)
3. Open the binary, set BP at entry → continue
4. ScyllaHide neutralizes most checks transparently

IDA Pro

• Built-in remote debugger + IDAStealth plugin
• For step-tracing through anti-debug: Debugger options → Suspend on library load/unload = no

radare2 / r2dbg

r2 -d /tmp/sample
> e dbg.aslr = false
> dc                  # continue, see where it dies
> dbt                 # backtrace at SIGSEGV / exit

gdb / pwndbg

For Linux:

gdb /tmp/sample
> set follow-fork-mode parent
> set detach-on-fork off
> catch syscall ptrace
> run
# When hit, override
> return 0
> continue

5. Patching for static-replay analysis

If you only need to analyze the unpacked / decrypted state, sometimes easier to patch the anti-debug checks to no-ops:

# Find the check
r2 -A /tmp/sample
> afl ~ debug
> s sym.imp.IsDebuggerPresent
> /c call sym.imp.IsDebuggerPresent
> # for each hit, patch w/ "xor eax,eax; ret"
> wx 31c0c3 @ <addr>

Caution: patching may break self-checksums. Run static-validation YARA post-patch to ensure binary still loads.

6. Promote

kg_add_node(kind="observation", label="anti-debug: <check-name>",
            props={"sample":"<sha256>","check":"<name>","bypassed":<bool>})
kg_add_edge(src=<sample>, dst=<observation>, kind="exhibits")

OPSEC (for malware analysis)

• Run in isolated VM w/ NO connectivity to your network — many anti-VM checks involve DNS / HTTP probes
• Snapshot before run, revert after
• Don't analyze on host w/ persistent creds in browsers
• For commercial protected SW (legitimate analysis), document authorization to bypass DRM-adjacent protections

Tool cheat sheet

Known exemplars

• Stuxnet: multiple anti-VM checks (Siemens PLC env detection)
• Conti / Ryuk: PEB checks, sleep timer skipping, mouse-cursor check
• Most banking trojans (Trickbot, Emotet): full Anti-Debug + anti-sandbox + anti-emul
• Cobalt Strike beacons: lighter anti-debug, more anti-AV focus
• iOS / Android packers: ptrace + frida-detect (objection bypasses most)