## Anti-Debugging in Rust

Welcome to the **AntiDebugging** directory of [`Rust-for-Malware-Development`](https://github.com/Whitecat18/Rust-for-Malware-Development).
These PoCs let a process notice when it is being watched by a debugger and bail out (or misbehave) when it is. Useful in stealth payloads that want to dodge live analysis.

## Sections & Links

- [CheckRemoteDebuggerPresent](https://github.com/Whitecat18/Rust-for-Malware-Development/tree/main/AntiDebugging/CheckRemoteDebuggerPresent):
  Calls `CheckRemoteDebuggerPresent` — the documented Win32 way to ask Windows whether a debugger is attached to a given process.

- [ProcessDebugPort](https://github.com/Whitecat18/Rust-for-Malware-Development/tree/main/AntiDebugging/ProcessDebugPort):
  Queries `NtQueryInformationProcess(ProcessDebugPort)`. If a debugger is attached the port is non-zero.

- [UnhandledExceptionFilter](https://github.com/Whitecat18/Rust-for-Malware-Development/tree/main/AntiDebugging/UnhandledExceptionFilter):
  Triggers an exception on purpose and watches the filter chain. Under a debugger the unhandled-exception filter does not fire, which gives the trick away.

- [debug_teb](https://github.com/Whitecat18/Rust-for-Malware-Development/tree/main/AntiDebugging/debug_teb):
  Reads the `BeingDebugged` flag directly out of the PEB through the TEB. No API call, so it is harder for an EDR to hook.

## How to Use

```bash
git clone https://github.com/Whitecat18/Rust-for-Malware-Development.git
cd Rust-for-Malware-Development/AntiDebugging
```

Each sub-folder is its own Cargo project. Build with `cargo build --release`.

## Resources

* https://anti-debug.checkpoint.com/