Whitecat18
28e7fac1d3
Rust-for-Malware-Development is an collection of proof of concepts with techniques and advanced evasion methods
Anti-Debugging in Rust
Welcome to the AntiDebugging directory of Rust-for-Malware-Development.
These PoCs let a process notice when it is being watched by a debugger and bail out (or misbehave) when it is. Useful in stealth payloads that want to dodge live analysis.
Sections & Links
-
CheckRemoteDebuggerPresent: Calls
CheckRemoteDebuggerPresent— the documented Win32 way to ask Windows whether a debugger is attached to a given process. -
ProcessDebugPort: Queries
NtQueryInformationProcess(ProcessDebugPort). If a debugger is attached the port is non-zero. -
UnhandledExceptionFilter: Triggers an exception on purpose and watches the filter chain. Under a debugger the unhandled-exception filter does not fire, which gives the trick away.
-
debug_teb: Reads the
BeingDebuggedflag directly out of the PEB through the TEB. No API call, so it is harder for an EDR to hook.
How to Use
git clone https://github.com/Whitecat18/Rust-for-Malware-Development.git
cd Rust-for-Malware-Development/AntiDebugging
Each sub-folder is its own Cargo project. Build with cargo build --release.