Anti-Reversing Techniques

The skill provides explicit examples of using `LD_PRELOAD` for shared library injection to hook system calls and GDB commands to directly manipulate process registers and execution flow. These are powerful techniques for runtime code injection and altering program behavior, which can be used to bypass security controls or achieve arbitrary code execution within a target process.

LD_PRELOAD=./hook.so ./target
catch syscall ptrace
set $rax = 0

The provided Python script demonstrates reading arbitrary binary files from the filesystem. While intended for pattern scanning, this capability could be repurposed by an agent for unauthorized file access or data exfiltration.

data = open(path, "rb").read()

The skill explicitly states its ability to produce executable code artifacts, including Python/IDAPython scripts, GDB command sequences, and C stubs. This indicates the agent is designed to generate or provide code that can perform system-level actions.

Code artifacts: Python/IDAPython scripts, GDB command sequences, or C stubs for bypassing or implementing checks

The skill details various methods for identifying system properties and environment characteristics, such as virtual machine presence or debugger attachment, through CPUID checks, MAC address enumeration, registry/file detection, and process checks.

CPUID-based detection, MAC address prefix, Windows registry keys, /proc/self/status

The skill provides detailed instructions for detecting virtualized/sandboxed environments via CPUID hypervisor bit, MAC address prefixes, registry keys, file artifacts, process names, and timing anomalies. While framed as educational, this is a complete anti-analysis evasion toolkit that could be used to build malware that evades dynamic analysis sandboxes.

CPUID-based detection... if (cpuid_info[2] & (1 << 31)) { // Running in hypervisor }... 'VMwareVMware', 'Microsoft Hv', 'KVMKVMKVM', 'VBoxVBoxVBox'... MAC address prefix VMware: 00:0C:29, 00:50:56... C:\Windows\System32\drivers\vmmouse.sys

Complete, working C code and a ready-to-run Python scanner are provided for detecting debuggers and VMs via timing anomalies (RDTSC, QueryPerformanceCounter, GetTickCount). The Python script is immediately executable and scans binaries for anti-debug patterns — this is an operational tool, not merely documentation.

#!/usr/bin/env python3
"""Scan a binary for common timing-based anti-debug patterns."""
import re
import sys

PATTERNS = {
    "RDTSC": rb"\x0f\x31",
    "RDTSCP": rb"\x0f\x01\xf9",
    ...
def scan(path: str) -> None:
    data = open(path, "rb").read()

A working LD_PRELOAD shared library technique for bypassing ptrace-based anti-debugging is provided with compile instructions. This is an actionable bypass tool that could be used to circumvent security controls on arbitrary binaries beyond legitimate analysis contexts.

# hook.c: long ptrace(int request, ...) { return 0; }
# gcc -shared -fPIC -o hook.so hook.c
LD_PRELOAD=./hook.so ./target

A complete GDB command sequence is provided to intercept and neutralize ptrace syscalls, manipulate CPU flags to bypass conditional checks, and intercept file open calls to redirect /proc/self/status reads. This is a functional exploit script, not merely conceptual documentation.

catch syscall ptrace
commands
  silent
  set $rax = 0
  continue
end
...
catch syscall openat
commands
  silent
  # If arg contains "status", patch the fd result to /dev/null equivalent
  continue
end

IDAPython code for patching arbitrary bytes in binaries is provided (ida_bytes.patch_byte), enabling modification of any binary's protection checks. While standard in reverse engineering, the skill provides this as a reusable pattern for neutralizing security controls.

In IDA: `ida_bytes.patch_byte(check_addr, 0x90)` ... def decrypt_xor(ea, length, key):
    result = ""
    for i in range(length):
        byte = ida_bytes.get_byte(ea + i)
        result += chr(byte ^ key)
    return result

The skill repeatedly references an external file 'references/advanced-techniques.md' for more advanced offensive techniques (RDTSC delta calibration, VMware backdoor port, self-modifying code, ROP as obfuscation). This external resource is not included or audited, creating a supply-chain risk where more dangerous content could be loaded.

For advanced techniques, see [references/advanced-techniques.md](references/advanced-techniques.md) ... For advanced VM detection (RDTSC delta calibration, VMware backdoor port, hypervisor leaf enumeration...), see [references/advanced-techniques.md] ... For advanced anti-disassembly tricks (overlapping instructions, junk byte insertion, self-modifying code, ROP as obfuscation), see [references/advanced-techniques.md]

Debugger, VM, or container detection — environment fingerprinting to evade analysis

IsDebuggerPresent

Debugger, VM, or container detection — environment fingerprinting to evade analysis

ptrace(PTRACE_TRACEME