Anti-Debugging – A Developers View

[Nytro]

Anti-Debugging – A Developers View

Tyler Shields

tshields a veracode.com

Veracode Inc., USA

4 Van de Graaff Drive, Burlington, MA 01803

Abstract— Anti-debugging is the implementation of one or more

techniques within computer code that hinders attempts at

reverse engineering or debugging a target binary. Within this

paper we will present a number of the known methods of antidebugging

in a fashion that is easy to implement for a developer

of moderate expertise. We will include source code, whenever

possible, with a line by line explanation of how the antidebugging

technique operates. The goal of the paper is to educate

development teams on anti-debugging methods and to ease the

burden of implementation.

Keywords— anti-debugging, security, debugging, copy

protection, anti-piracy, reverse engineering

I. INTRODUCTION

Anti-debugging, when implemented properly, can be a

significant deterrence to would be reverse engineers and

software pirates. There is no foolproof solution to thwart the

dedicated reverse engineer; however, making the task as

arduous and difficult as possible increases the time and

expertise required for full analysis of the binary application.

Application developers should not be required to spend

significant amounts of time understanding and examining the

specifics of a software protection scheme. Straight forward

implementation of a best of breed solution helps to achieve the

aforementioned goals while leaving the developer additional

time to implement features and other necessary application

components.

The majority of data on the topic of anti-debugging has

been presented from the vantage point of a reverse engineer.

Anti-debugging methods typically have been presented in

assembly language dumps with minimal explanation as to the

high level code constructs involved in the technique. Unless

the developer is adept at reading and comprehending assembly

language code, the anti-debugging method is

incomprehensible and thus will not be implemented.

Download:

http://shell-storm.org/papers/files/764.pdf