---
name: anti-reversing-techniques
description: Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use when analyzing protected binaries, bypassing anti-debugging for authorized analysis, or understanding software protection mechanisms.
enabled: false
source: github:JuanJoseGonGi/skills
imported-from: github:JuanJoseGonGi/skills
---

> **AUTHORIZED USE ONLY**: This skill contains dual-use security techniques. Before proceeding with any bypass or analysis:
>
> 1. **Verify authorization**: Confirm you have explicit written permission from the software owner, or are operating within a legitimate security context (CTF, authorized pentest, malware analysis, security research)
> 2. **Document scope**: Ensure your activities fall within the defined scope of your authorization
> 3. **Legal compliance**: Understand that unauthorized bypassing of software protection may violate laws (CFAA, DMCA anti-circumvention, etc.)
>
> **Legitimate use cases**: Malware analysis, authorized penetration testing, CTF competitions, academic security research, analyzing software you own/have rights to

# Anti-Reversing Techniques

Understanding protection mechanisms encountered during authorized software analysis, security research, and malware analysis. This knowledge helps analysts bypass protections to complete legitimate analysis tasks.

## Anti-Debugging Techniques

> Full implementations and bypass code: `references/anti-debugging.md`

### Windows Anti-Debugging

| Technique | How It Works | Bypass |
|---|---|---|
| **API-based** (`IsDebuggerPresent`, `CheckRemoteDebuggerPresent`, `NtQueryInformationProcess`) | Queries OS for debugger state via API calls | ScyllaHide plugin; patch return values; hook API |
| **PEB-based** (`BeingDebugged`, `NtGlobalFlag`, heap flags) | Reads Process Environment Block fields directly | Modify PEB in debugger memory; clear `NtGlobalFlag` |
| **Timing-based** (`RDTSC`, `QueryPerformanceCounter`, `GetTickCount`) | Measures execution time — debugger stepping is slow | Hardware breakpoints; patch checks; hook timing APIs |
| **Exception-based** (SEH/VEH with `INT 3`, single-step) | Debuggers consume exceptions meant for the program | Pass exceptions to application; configure debugger exception handling |

### Linux Anti-Debugging

| Technique | How It Works | Bypass |
|---|---|---|
| **ptrace self-trace** | `PTRACE_TRACEME` fails if already traced | `LD_PRELOAD` hook returning 0 |
| **/proc/self/status** | Reads `TracerPid` field | Patch file read or hook `fopen`/`fgets` |
| **Parent process check** | Validates parent isn't a debugger | Spoof parent or patch check |

## Anti-VM Detection

> Full implementations and bypass code: `references/anti-vm.md`

### Detection Methods

| Technique | Indicators Checked | Bypass |
|---|---|---|
| **CPUID hypervisor bit** | Bit 31 of ECX from `CPUID(1)` | Bare-metal; mask CPUID results |
| **CPUID vendor string** | `CPUID(0x40000000)`: "VMwareVMware", "Microsoft Hv", "KVMKVMKVM" | Patch CPUID or use hardened VM |
| **MAC address prefix** | VMware: `00:0C:29`, `00:50:56`; VBox: `08:00:27`; Hyper-V: `00:15:5D` | Change VM MAC address |
| **Registry/files** | VM tools registry keys, driver files (`vmmouse.sys`, `VBoxMouse.sys`) | Remove guest tools; clean artifacts |
| **Process names** | `vmtoolsd.exe`, `VBoxService.exe` | Kill/rename VM tool processes |
| **Timing (CPUID exit)** | `CPUID` takes >500 cycles in VM due to VM exits | Bare-metal; specialized VMs (FLARE-VM) |

## Code Obfuscation

> Full implementations and analysis scripts: `references/obfuscation.md`

### Control Flow Obfuscation

| Technique | Description | Analysis Approach |
|---|---|---|
| **Control flow flattening** | Replaces structured code with state-machine `switch` loop | Identify state variable; map transitions; tools: D-810, SATURN |
| **Opaque predicates** | Conditions that always evaluate the same way but look complex (e.g., `x*x >= 0`) | Symbolic execution; pattern matching for known predicates |

### Data Obfuscation

| Technique | Description | Analysis Approach |
|---|---|---|
| **String encryption** | XOR, RC4, or custom ciphers decrypt strings at runtime | FLOSS tool; IDAPython decryption scripts |
| **Stack strings** | Characters assigned individually to stack buffer | Dynamic analysis; FLOSS stack string detection |
| **API hashing** | Resolves API functions by hash instead of name | Identify hash algo; HashDB plugin; build hash database |
| **Dynamic API resolution** | `LoadLibrary`/`GetProcAddress` at runtime | Dynamic analysis; log API resolution calls |

### Instruction-Level Obfuscation

| Technique | Description | Analysis Approach |
|---|---|---|
| **Dead code insertion** | Non-functional instructions mixed with real code | Data-flow analysis; identify no-effect instructions |
| **Instruction substitution** | Equivalent but different encodings (e.g., `sub eax,eax` for `xor eax,eax`) | Normalize to canonical forms; semantic analysis |

## Packing and Encryption

> Full methodology and examples: `references/packing-and-virtualization.md`

### Common Packers

| Packer | Type | Difficulty |
|---|---|---|
| UPX | Open-source compressor | Easy (`upx -d`) |
| Themida | Commercial VM protector | Hard |
| VMProtect | Commercial virtualizer | Hard |
| ASPack / PECompact | Compression packers | Medium |
| Enigma | Commercial protector | Medium-Hard |

### Unpacking Workflow

1. **Identify packer**: DIE (Detect It Easy), Exeinfo PE, PEiD
2. **Try static unpacking**: Known unpackers (e.g., `upx -d`)
3. **Dynamic unpacking** if static fails:
   - Find Original Entry Point (OEP) using ESP trick or API breakpoints
   - Dump memory at OEP
   - Fix imports with Scylla / ImpREC

## Virtualization-Based Protection

> Full analysis approaches: `references/packing-and-virtualization.md`

Converts native x86/x64 to custom bytecode run by an embedded interpreter.

### VM Components to Identify

- **VM entry** — dispatcher function
- **Handler table** — maps opcodes to handler routines
- **Bytecode** — custom instruction stream
- **Virtual registers/stack** — VM's execution state

### Analysis Strategy

1. **Trace execution**: Log handler calls, map bytecode to operations
2. **Lifting/devirtualization**: Map VM instructions back to native (VMAttack, SATURN, NoVmp)
3. **Symbolic execution**: Analyze semantically with angr or Triton

## Bypass Strategies Summary

### General Principles

1. **Understand the protection**: Identify what technique is used before attempting bypass
2. **Find the check**: Locate protection code in the binary
3. **Patch or hook**: Modify check to always pass
4. **Use appropriate tools**: ScyllaHide, x64dbg plugins, LD_PRELOAD hooks
5. **Document findings**: Keep notes on bypassed protections

### Tool Quick Reference

| Purpose | Tools |
|---|---|
| Anti-debug bypass | ScyllaHide, TitanHide |
| Unpacking | x64dbg + Scylla, OllyDumpEx |
| Deobfuscation | D-810, SATURN, miasm |
| VM analysis | VMAttack, NoVmp, manual tracing |
| String decryption | FLOSS, custom IDAPython scripts |
| Symbolic execution | angr, Triton |

### Ethical Considerations

This knowledge should only be used for:

- Authorized security research
- Malware analysis (defensive)
- CTF competitions
- Understanding protections for legitimate purposes
- Educational purposes

Never use to bypass protections for:

- Software piracy
- Unauthorized access
- Malicious purposes
