PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Malware development part 3 - anti-debugging

0xpat.github.io | blog | #windows | #red-team | #anti-debugging | #malware-development | #evasion | #peb
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part 3 of the malware dev series: detecting debuggers via IsDebuggerPresent, PEB flags, NtQueryInformationProcess artifacts and breakpoint checks—plus tricks to hinder manual analysis.
Published
Collected

Related coverage

blog · 0xpat.github.io
Malware development part 2 - anti dynamic analysis & sandboxes
Malware dev part 2: sandbox and VM detection for dynamic-analysis evasion—fingerprinting limited resources, indicative device names and artifacts to tell real hosts from analysis environments.
blog · bishopfox.com
Rust for Malware Development
Bishop Fox compares Rust and C/C++ for malware: larger, harder-to-analyze binaries complicate reverse engineering and can slip past signature detection — demonstrated with a simple shellcode dropper.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
tool · github.com
IUM-Debugger: Patching Secure Kernel to Enable Debugging of VTL 1 Isolated User Mode Trustlets
Overcomes signature-enforced boot protections on securekernel.exe to unlock dynamic live debugging of Windows VBS trustlets (e.g., Credential Guard), greatly simplifying reverse engineering and vulnerability research against isolated secure enclaves.
blog · 0xpat.github.io
Malware development part 9 - hosting CLR and managed code injection
Malware development part 9: executing managed .NET assemblies from native code—hosting the CLR via ICLRRuntimeHost/ICorRuntimeHost, and running payloads from memory rather than disk.
blog · 0xpat.github.io
Malware development part 8 - COFF injection and in-memory execution
Part 8 of the malware dev series: a COFF object-file loader à la Cobalt Strike's BOFs—compiling C to .obj, parsing headers, sections and relocations, then executing the machine code from memory.
Back