Anti-debugging is a series of anti-reversing techniques used by malware (and even some legitimate programs) to hamper or prevent debugging. For example, the malware might try to interfere with the debugger process if it detects that it’s attached to a debugger, or it might try to prevent debugging altogether by using so-called anti-attach mechanisms or crashing the debugger program. In this chapter, we’ll explore some of these techniques in detail.
Using Windows API Functions to Access the PEB
As you learned in Chapter 1, the Process Environment Block (PEB) is a structure that contains pointers to information in memory ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month, and much more.
