Anti-Reversing Techniques

The skill provides explicit instructions for code injection via LD_PRELOAD on Linux and detailed commands for runtime manipulation and binary patching using debuggers (GDB, IDA, x64dbg). These techniques allow for arbitrary code execution and alteration of program behavior.

LD_PRELOAD=./hook.so ./target; ida_bytes.patch_byte(check_addr, 0x90); GDB command sequence to set $rax = 0.

The skill details numerous methods for detecting debugging environments (e.g., IsDebuggerPresent, ptrace, /proc/self/status) and virtual machines (e.g., CPUID, registry/file checks). It also includes a Python script for scanning binaries for anti-debug patterns.

if (IsDebuggerPresent()) { exit(1); }; if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) == -1); Python script to scan for common timing-based anti-debug patterns.

The skill provides detailed techniques for detecting virtualized/sandboxed environments including CPUID hypervisor bit checks, vendor string identification, MAC address prefix detection, registry/file artifact enumeration, and timing anomaly detection. While framed as educational, this constitutes a comprehensive guide for evasion of analysis sandboxes.

// CPUID-based detection
int cpuid_info[4];
__cpuid(cpuid_info, 1);
// Check hypervisor bit (bit 31 of ECX)
if (cpuid_info[2] & (1 << 31)) {
    // Running in hypervisor
}
// CPUID brand string ... "VMwareVMware", "Microsoft Hv", "KVMKVMKVM", "VBoxVBoxVBox"

The skill provides complete working instructions for creating and using an LD_PRELOAD shared library to intercept and neutralize ptrace anti-debugging calls. This is a functional technique usable directly for bypassing security controls in unauthorized contexts.

# hook.c: long ptrace(int request, ...) { return 0; }
# gcc -shared -fPIC -o hook.so hook.c
LD_PRELOAD=./hook.so ./target

The embedded Python script reads arbitrary files from disk via a command-line argument without any path validation or sandboxing. When executed by an agent in an automated pipeline, this could be directed at sensitive files beyond the intended binary targets.

def scan(path: str) -> None:
    data = open(path, "rb").read()
    print(f"Scanning: {path} ({len(data)} bytes)\n")

The skill explicitly states it contains 'dual-use security techniques' and provides warnings about legal compliance and authorized use. While not malicious, this framing highlights the high-risk nature of the capabilities described.

AUTHORIZED USE ONLY: This skill contains dual-use security techniques. ... Legal compliance: Understand that unauthorized bypassing of software protection may violate laws (CFAA, DMCA anti-circumvention, etc.)

The skill uses repeated authorization framing ('AUTHORIZED USE ONLY', 'legitimate security context', 'ethical considerations') that could be leveraged to convince an agent or human overseer that generating anti-debugging/anti-VM bypass code is sanctioned, potentially lowering scrutiny on requests that combine these techniques maliciously.

> **AUTHORIZED USE ONLY**: This skill contains dual-use security techniques. Before proceeding with any bypass or analysis:
>
> 1. **Verify authorization**: Confirm you have explicit written permission...