admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

format change

Browse Source
This commit is contained in:
Desiree Beck
2019-12-31 12:47:27 -05:00
parent ac8f193324
commit b117befa7d
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
anti-behavioral-analysis/detect-debugger.md
+2 -2
View File
@@ -9,7 +9,7 @@ Debugger Detection
==================
Malware detects whether it's being executed inside a debugger. If so, conditional execution selects a benign execution path. [[1]](#1), [[2]](#2)
Details on methods of detecting debuggers are given in [[3]](#3),[[5]](#5), and [[7]](#7); many are listed as methods below.
Details on methods of detecting debuggers are given in [[3]](#3),[[5]](#5), and [[7]](#7); many are listed below.
Methods
-------
@@ -31,7 +31,7 @@ Methods
* **Software Breakpoints**: (INT3/0xCC)
* **Memory Breakpoints**: (PAGE_GUARD); Guard pages trigger an exception the first time they are accessed and can be used to detect a debugger. See [[7]](#7) for details.
* **Interrupt 0x2d**: If int 0x2d is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware.
* **Interrupt 1**:
* **Interrupt 1**: [[7]](#7)
* **Parent Process**: (Explorer.exe); Executing an application by a debugger will result in the parent process being the debugger process rather than the shell process (Explorer.exe) or the command line. Malware checks its parent process; if it's not explorer.exe, it's assumed to be a debugger. [[7]](#7)
* **SeDebugPrivilege**: (Csrss.exe); Using the OpenProcess function on the csrss.exe process can detect a debugger. [[7]](#7)
* **NtYieldExecution/SwitchToThread**: [[7]](#7)