anti-analysis anti-debug anti-debugging antianalysis antidebug antidebugging

AntiDebug.NET :: Anti-debugging made easy

Protect your .NET program from being debugged!

Various anti-debugging and anti-vm, anti-sandbox techniques are all supported!

To prevent detection and ease obfuscation, all sensitive function calls are handled indirectly and dynamically. Instead of using direct P/Invoke, they're all retrieved dynamically via hand-made GetProcAddress alternative. (Manually scan IAT to find function, to bypass GetProcAddress hooking)

Complicated anti-debug features are implemented using a native DLL. It is loaded 'in-memory' (without leaving file on disk) when it's executed and freed on exit.

Disclaimer

Use at your own risk! Your program may not work after applying AntiDebug.NET.

As it uses various Anti-Anti-Anti-Debug techniques, your Anti-virus softwares may complain about your program as if it is infected.

This project Manual Maps DLL: `kernel32.dll` and `ntdll.dll`

Popular Anti-Anti-Debug solutions such as ScyllaHide just hooks all debugging-related functions and manipulates its parameters or return value to bypass Anti-Debug solutions.

There is a lot of methods to counter this. Basically, this problem is very similar to 'AV/EDR bypassing.' There is a great documentation about this.

AntiDebug.NET do manual map the whole kernel32.dll and ntdll.dll modules using StealthModule.NET to the process memory and then call its exports.

Since this solution is also (in-)famous for AV/EDR bypassing method, your Anti-virus software may start screaming on this. It may terminate, quarantine or delete your program right after.

As there is no malicious intention of this manual-mapping behavior, you can ignore the warning or notification from your anti-virus.

If you really doubt about it, feel free to look around this repository, and look if there is any malicious code.

Binary files are not available for download or share

This project will NOT be published anywhere such as NuGet, GitHub Release, etc. in a binary form as it could trigger web antiviruses and safe search.

You should download the project and then manually compile it. Then copy the 'AntiDebugLib.dll' to your project and then add reference to it.

Don't forget to add the project folder (or at least the dll output folder) to the exclusion list of antivirus!

Usage

using AntiDebugLib;

There are two types of checks. Passive checks are executed once at the begin. Active checks are executed for each 3 seconds. (This period can be changed)

Standard usage (detect debuggers)

Initialize the AntiDebug modules, register the event handler, and then begin the job.

AntiDebug.Initialize() will create and initialize check and prevention instances.

AntiDebug.BeginChecks() will perform all passive checks, then start a thread to perform active checks periodically. You can specify the optional int parameter to set active check execution period in milliseconds.

AntiDebug.Initialize();
AntiDebug.DebuggerDetected += AntiDebug_DebuggerDetected;
AntiDebug.BeginChecks();

The handler method

private static void AntiDebug_DebuggerDetected(object sender, DebuggerDetectedEventArgs e)
{
    Console.WriteLine("A potential debugging behavior is detected! (Check name: " + e.Result.CheckName + ", Check reliability: " + e.Result.Reliability + ")");
}

Monitoring usage (print all check and prevention results)

The code is too long to note here. See Program.cs in AntiDebugSample project for the exact implementation.

Changing magic values

For those who worried about getting caught by native export name strings: Use RenameNativeExports.ps1; it will help you to rename native dll export names.

You can also edit the native dll XOR encryption key with this tool.

Usage:

Open the powershell, set cwd to this project solution folder. (use pushd command to set cwd to the folder where ChangeMagics.ps1 file is located)
Enter: .\ChangeMagics.ps1
Enter the function names you want.
Don't forget to re-build the solution!

al-khaser

About

Various .NET Anti-Debug and Anti-VM techniques

anti-analysis anti-debug anti-debugging antianalysis antidebug antidebugging

MIT License

Languages

Language:C# 80.8%Language:C++ 15.9%Language:C 1.9%Language:PowerShell 1.2%Language:Assembly 0.2%

hsheric0210 / AntiDebug.NET

AntiDebug.NET :: Anti-debugging made easy

Disclaimer

This project Manual Maps DLL: `kernel32.dll` and `ntdll.dll`

Binary files are not available for download or share

Usage

Standard usage (detect debuggers)

Monitoring usage (print all check and prevention results)

Changing magic values

Related articles and repositories

Related Articles

Anti-unpacker tricks by Peter Ferrie

Related Repositories

TODO list

ShowStopper (= Checkpoint Research Anti-Debug Tricks)

al-khaser

About

Languages

AntiDebug.NET :: Anti-debugging made easy

Disclaimer

This project Manual Maps DLL: kernel32.dll and ntdll.dll

Binary files are not available for download or share

Usage

Standard usage (detect debuggers)

Monitoring usage (print all check and prevention results)

Changing magic values

Related articles and repositories

Related Articles

Anti-unpacker tricks by Peter Ferrie

Related Repositories

TODO list

ShowStopper (= Checkpoint Research Anti-Debug Tricks)

al-khaser

About

Languages

This project Manual Maps DLL: `kernel32.dll` and `ntdll.dll`