Unhooking:
- Disables user-mode function hooks by manually loading ntdll.dll from disk and check for modifications.
- If modifications exist it overwrites with the valid ntdll and calls anti-debug functions based on ntdll from there.
- Todo:Unhooking for every loaded dll
Anti-debugging:
- IsDebuggerPresent()
- PEB.BeingDebugged flag using speculative execution
- PEB.NtGlobalFlag
- Heap Flags
- Self-Debugging
- Anti-Step-Over
- NtSetInformationThread()
- Dynamic TlsCallbacks
- NtQueryInformationProcess()
- RDTSC
- RtlQueryProcessDebugInformation()
- Selectors
- Uses NtTerminateProcess() or SwitchDesktop() or NtShutdownSystem() to terminate/crash the debugging/VM session
Anti-VM:
- CPUID (Hypervisor presence)
- CPUID (Hypervisor vendor)
- Number of Processors
- Device Drivers
- NtGetTickCount
Process Injection:
- ANTI automatically migrates in a remote process when it detects a debugger using NtCreateThreadEx technique.
An overview of how ANTI works:
- Idapro, Version 7, 5
- Immunity Debugger, Version 1.85
- OllyDebugger v1.10, v.2
- CheatEngine
- x64dbg, Build Aprl 5 2018
- Windbg 10
- Obsidian debugger, Version 0.11
- Microsoft Visual Studio Debugger, Version 15.4.0
- PhantOm v1.85
- StrongOD v0.4.8.892
- OllyAdvanced v1.27
- SharpOD v0.6
- aadp v0.2
- HideDebugger v1.2.4
- IDA Stealth
- OllyExt
- makin
- ScyllaHide
- Apate
- ApiMonitor v2
- anti.exe <target file> <section name> <pid>
ANTI is licensed under the MIT License.
Credits to Peter Ferrie for his “Ultimate”Anti-Debugging Reference