anti-debug | Android detect debugger | Code Inspection library

This is the defacto antidebug reference by Peter Ferrie, it's an amazing resource: https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf

It contains almost every known anti-debug method, you can use this reference and tick each method off your list until you find the ones that are implemented, the book should also help you easily mitigate each method as well.

Per our conversation in the comments, the answer to your question was that the process was hooking both DbgBreakPoint and DbgUiRemoteBreakig. Patching them enabled you to then attach a debugger.

@PeterCordes is right (look in the comments). It's because of ASLR, I just tested the code with ASLR Off and the sum is always the same.

Based on @MarkPlotnick's comments, here is the golang Equivalent code for the c++ code posted by me.

At a very high level, this can't work. When an application calls _Exit (possibly/likely at the end of exit), it has no path to any further code to be run. These functions are normally even marked _Noreturn, meaning that the compiler does not leave the registers/calling stack frame in a meaningful state where resumption of execution could occur. Even if it did, the program itself at the source level is not prepared to continue execution.

If the function somehow returned, the next step would be runaway wrong code execution, likely leading to arbitrary code execution under the control of an attacker if the application had been processing untrusted input of any kind.

In practice, the libc side implementation of the exit and _Exit functions likely hardens against kernel bugs (yes, what you're asking for is a bug) whereby SYS_exit_group fails to exit. I haven't verified other implementations lately but I know mine in musl do this, because it's cheap and the alternative is very dangerous.

You're almost there, but your current code has two issues:

First of all your P/Invoke declaration for the NtSetInformationThread function is not quite correct and I recommend you stick to DllImport as most Declare Function declarations that you find on the internet were written for VB6 and are not compatible with VB.NET.

Here is the corrected version:

First of all ptrace() is not part of public API on iOS. As per the AppStore publishing policy, use of non-public API is prohibited and use of them may lead to rejection of the app from the AppStore, so we need call it via function pointer using dlsym.

Full Code:

Both of those techniques are relatively old. I think they were in use in the early 2000s, if not the late 90s.

The first uses the fact that the Thread-Information Block (TIB) resides at fs:[0] for windows processes (at least as late as WinXP...I haven't looked since then).

Offset 0x30 into the TIB is a pointer to the Process Environment Block (PEB). From that link, we see that offset 0x2 into the PEB is the 'being debugged' flag. This is the value that is read by the API call IsDebuggerPresent.

The second example demonstrates two detection mechanisms:

This answer gives good detail on the function of int 0x2d on windows. For the moment, we'll just note that it's part of Windows' built-in debugging support.

The simpler mechanism is this: Structured exception handling in Windows would catch things that the language-based exceptions couldn't, because it was hooked into the OS's exception handling framework, not the language-runtime's.

So the int 0x2d would generate a fault; any debugger present would handle the fault, and because this interrupt is for debugging, the debugger would return to control-flow as usual. Thus the structured-exception handling mechanism wouldn't be invoked...so the 'catch' would never be reached, and the return value of the function would thereby change. This method was pretty trivially defeated by later SEH-aware debuggers, by telling the debugger to pass the exception to the program, in which case the SEH would fire.

The other mechanism is based in the detail of the of way int 0x2d is processed by windows, which was apparently not emulated perfectly by OllyDbg (a once phenomenal debugger that went defunct and came back full of malware). I am not personally familiar with this method, so I would direct you to the linked answer.

Just for context, the early days of anti-debugger techniques were studies of particularly popular debug tools. In whatever document you've dug these techniques from, you will no doubt also see ones dedicated to detecting NuMega Softice --- probably the first kernel debugger for Windows (circa NT 4.0). The instruction sequence from whence my handle is derived was used as a method of detecting this debugger.

Thanks for the trip down memory lane ;)

The certificate is not more valid if only 1 byte of the executable changed. It seems you use Properties window of Windows Explorer and after changing the version number see the Digital Signature tab still there. This is very misleading about digital signature of executable files in Windows but not true. This tab just say the file contain certificate but nothing about validation of this certificate. In this tab click on certificate and then click on Details, now on top of the opened window you can see the cert is valid or not.

By using Windows API you can check the certificate is valid or not, maybe this topic help you in C#.