ptn1411/skill/anti-debugging-techniques

ptrace(           # PTRACE_TRACEME self-attach
fopen("/proc/self/status"      # TracerPid scan
fopen("/proc/self/maps"        # Frida/LD_PRELOAD scan
rdtsc                          # timing measurement
signal(SIGTRAP                 # signal-swallowed test
fork()                         # potential watchdog parent/child

# bash / WSL
cat > /tmp/ap.c <<'EOF'
long ptrace(int r, int p, void *a, void *d) { return 0; }
EOF
gcc -shared -fPIC -o /tmp/ap.so /tmp/ap.c
LD_PRELOAD=/tmp/ap.so ./target

(gdb) catch syscall ptrace
(gdb) commands
> set $rax = 0
> continue
> end

// Linux ptrace
Interceptor.replace(
  Module.getExportByName(null, 'ptrace'),
  new NativeCallback(() => 0, 'long', ['int', 'int', 'pointer', 'pointer'])
);
// Windows IsDebuggerPresent
Interceptor.replace(
  Module.getExportByName('kernel32.dll', 'IsDebuggerPresent'),
  new NativeCallback(() => 0, 'int', [])
);

& 'C:\Tools\x64dbg\x64\x64dbg.exe' 'C:\Program Files\MyApp\target.exe'
# In GUI: Plugins → ScyllaHide → Options →
#   PEB BeingDebugged, NtGlobalFlag, HeapFlags
#   NtQueryInformationProcess (all classes)
#   NtSetInformationThread (HideFromDebugger)
#   GetTickCount, QueryPerformanceCounter
# → Apply → restart session

🛡️ Bypass Anti-Debug hoàn tất:
  🔍 Phát hiện     : <DETECTION_TYPES>
  🛠️ Bypass        : <METHODS>
  🧰 Công cụ        : <ScyllaHide | Frida | LD_PRELOAD | GDB>
  ✅ Verify        : chạy không exit sớm dưới debugger
 
▶  Tiếp:
   binary-protection-bypass (nếu ASLR/PIE chặn patch)
   → binary-patcher (vá license check)