skills.rest
SanketAdlak
SanketAdlakCOMMUNITY
Explore all skills by this author →
Website𝕏@devsanket14GitHub

anti-reversing-techniques

Identify and bypass anti-debugging, anti-VM, and obfuscation techniques in binaries during authorized analysis.

Updated Apr 23, 2026
Search Tags:#reverse engineering#binary analysis#obfuscation#unpacking#anti-debugging#malware analysis#x64dbg
One-click install
npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill anti-reversing-techniques-sanketadlak
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: anti-reversing-techniques
Source: https://github.com/SanketAdlak/PDMProjectDesign/tree/main/.agents/skills/anti-reversing-techniques
Command: npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill anti-reversing-techniques-sanketadlak

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Analysts reverse engineering packed or protected binaries encounter anti-debugging checks, VM detection, and obfuscated code that block dynamic analysis. This Skill provides the detection patterns, bypass strategies, and tooling needed to neutralize these protections during authorized malware analysis, CTF work, and security research. ## Core Features & Use Cases - Anti-Debugging Identification and Bypass: Recognize Windows API checks (IsDebuggerPresent, NtQueryInformationProcess), PEB flag inspection, timing checks (RDTSC), and Linux ptrace/TracerPid detection, with concrete bypass steps for x64dbg, GDB, and ScyllaHide. - Anti-VM and Obfuscation Analysis: Detect hypervisor fingerprints (CPUID leaves, registry artifacts, MAC prefixes) and analyze control flow flattening, opaque predicates, string encryption, and API hashing. - Use Case: A malware analyst loads a packed sample that exits immediately under a debugger. The Skill identifies a PEB BeingDebugged check and an RDTSC timing guard, then provides the exact patch addresses and ScyllaHide configuration to proceed with dynamic analysis. ## Quick Start Analyze the attached binary for anti-debugging and anti-VM protections and produce a bypass report with patch locations.

Frequently Asked Questions about anti-reversing-techniques

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I bypass anti-debugging checks in a Windows binary?▼

Use the ScyllaHide plugin in x64dbg, which automatically patches common checks like IsDebuggerPresent, PEB.BeingDebugged, and NtQueryInformationProcess. Manually, you can patch the BeingDebugged flag at PEB offset +2 to zero or NOP the conditional jump after each check.

How to detect if malware is checking for a virtual machine?▼

Look for CPUID hypervisor bit checks (bit 31 of ECX), hypervisor vendor strings like VMwareVMware or VBoxVBoxVBox, VM-specific MAC prefixes, and registry keys or driver files such as vmmouse.sys and VBoxService.exe. Timing anomalies around CPUID instructions also indicate VM detection.

What tools work best for unpacking packed binaries?▼

For UPX, use upx -d directly. For commercial protectors, use x64dbg with the ESP trick to find the Original Entry Point, then dump with Scylla and fix imports. Detect-It-Easy identifies the packer first via entropy and section analysis.

Does RDTSC timing detection work on ARM platforms?▼

No, RDTSC and CPUID are x86-only instructions. On ARM, equivalent checks use MRS with PMCCNTR_EL0 or clock_gettime with CLOCK_MONOTONIC. PEB-based checks also do not exist on ARM Linux, where /proc/self/status TracerPid is used instead.

Why does my bypass patch crash the binary instead of continuing?▼

NOPing a conditional jump can skip code that initializes heap state needed later, causing corruption. Instead, patch the comparison operand to the expected clean value, or use x64dbg's conditional breakpoint feature rather than modifying bytes.

How do I deobfuscate control flow flattening in IDA?▼

Identify the state variable and map state transitions in the dispatcher loop, then reconstruct the original flow. Tools like D-810 for IDA and SATURN automate this, while symbolic execution with angr or Triton handles opaque predicates.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

performing-static-malware-analysis-with-pe-studio

Analyzes Windows PE malware samples statically using PEStudio, pefile, and FLOSS to extract indicators.

Community
Advanced
trungdo9trungdo9
3

cti-expert

Automate cyber threat intelligence investigations using OSINT and forensic analysis.

Community
Advanced
langbyyilangbyyi
96

ctf-malware

Analyze obfuscated malware and decrypt C2 traffic for CTF challenges.

Community
Advanced
lNwNllNwNl

vm-and-bytecode-reverse

Reverse engineer custom virtual machines and bytecode interpreters in CTF binaries.

Community
Advanced