# Anti-Analysis Bypass Techniques Reference

Comprehensive reference of anti-analysis techniques used by malware and methods to bypass them.

## 1. Anti-Debugging Techniques

### 1.1 API-Based Detection

| Technique | API/Method | Detection | Bypass |
|-----------|-----------|-----------|--------|
| IsDebuggerPresent | `kernel32!IsDebuggerPresent` | Checks PEB.BeingDebugged flag | Patch call to return 0; set PEB.BeingDebugged = 0 |
| CheckRemoteDebuggerPresent | `kernel32!CheckRemoteDebuggerPresent` | Checks for remote debugger | Patch call; hook API to return FALSE |
| NtQueryInformationProcess | `ntdll!NtQueryInformationProcess` with `ProcessDebugPort` (7) | Returns debug port handle | Patch push 7 to push 0; hook ntdll |
| NtQueryInformationProcess | `ntdll!NtQueryInformationProcess` with `ProcessDebugObjectHandle` (0x1E) | Returns debug object handle | Patch; hook; use ScyllaHide |
| NtQueryInformationProcess | `ntdll!NtQueryInformationProcess` with `ProcessDebugFlags` (0x1F) | Returns NoDebugInherit flag | Patch; hook |
| OutputDebugString | `kernel32!OutputDebugStringA/W` | Checks last error after call | Ignore; no patch needed |
| NtSetInformationThread | `ntdll!NtSetInformationThread` with `ThreadHideFromDebugger` (0x11) | Hides thread from debugger | Patch push 0x11; hook API |
| NtQuerySystemInformation | `ntdll!NtQuerySystemInformation` with `SystemKernelDebuggerInformation` (0x23) | Detects kernel debugger | Patch; hook |

### 1.2 PEB-Based Detection

| Technique | Field | Detection | Bypass |
|-----------|-------|-----------|--------|
| BeingDebugged | PEB+0x02 | Non-zero when debugger attached | Set to 0 in debugger; patch binary |
| NtGlobalFlag | PEB+0x68 (32-bit) / PEB+0xBC (64-bit) | FLG_HEAP_ENABLE_TAIL_CHECK etc. | Clear flags; set to 0 |
| Heap Flags | Process heap flags | HEAP_TAIL_CHECKING_ENABLED etc. | Modify heap flags |
| ProcessHeap.ForceFlags | Heap+0x44 (32-bit) | Non-zero under debugger | Set to 0 |

### 1.3 Timing-Based Detection

| Technique | Method | Detection | Bypass |
|-----------|--------|-----------|--------|
| RDTSC | `rdtsc` instruction | Measures time delta between instructions | NOP rdtsc; patch comparison |
| GetTickCount | `kernel32!GetTickCount` | Measures execution time | Hook to return consistent values |
| QueryPerformanceCounter | `kernel32!QueryPerformanceCounter` | High-resolution timing | Hook; patch |
| timeGetTime | `winmm!timeGetTime` | Measures elapsed time | Hook; patch |
| GetSystemTime | `kernel32!GetSystemTime` | Timestamp comparison | Hook |

### 1.4 Exception-Based Detection

| Technique | Method | Detection | Bypass |
|-----------|--------|-----------|--------|
| INT 2D | `int 0x2d` instruction | Debugger handles differently than OS | Pass exception to application |
| INT 3 | `int 3` (CC breakpoint) | Checks if exception handler runs | Single-step past; use hardware BPs |
| EXCEPTION_BREAKPOINT | Structured exception handling | Different behavior under debugger | Configure debugger to pass exceptions |
| UnhandledExceptionFilter | Custom filter | Not called under debugger | Patch; set filter |

### 1.5 Hardware/Register Detection

| Technique | Method | Detection | Bypass |
|-----------|--------|-----------|--------|
| Hardware breakpoints | `GetThreadContext` / DR0-DR7 | Checks debug registers | Clear DRx before check; hook API |
| Software breakpoints | Scan code for 0xCC bytes | Finds int3 instructions | Use hardware BPs; memory BPs |
| Self-hashing | CRC/hash of code sections | Detects code modification | Recompute hash after patching |

## 2. VM Detection Techniques

### 2.1 Hardware Artifacts

| Technique | Check | Bypass |
|-----------|-------|--------|
| CPUID | Hypervisor bit (ECX bit 31) | Mask CPUID result; use `VBoxManage modifyvm --paravirtprovider none` |
| MAC address | VM vendor prefixes (00:0C:29, 08:00:27) | Change MAC to real vendor prefix |
| BIOS/SMBIOS | Vendor strings (VBOX, VMware, QEMU) | Modify BIOS strings in hypervisor config |
| ACPI tables | VBOX, VMWARE in DSDT | Patch ACPI tables |
| Disk model | VBOX HARDDISK, VMware Virtual | Rename virtual disk model |

### 2.2 Registry Artifacts (Windows)

| Key | Value | Bypass |
|-----|-------|--------|
| `HKLM\SYSTEM\...\Enum\IDE` | VBOX, VMWARE | Delete/modify registry keys |
| `HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions` | Exists | Remove key |
| `HKLM\SOFTWARE\VMware, Inc.\VMware Tools` | Exists | Remove key |
| `HKLM\HARDWARE\DESCRIPTION\System` | SystemBiosVersion contains VBOX | Modify value |

### 2.3 Process/Service Detection

| Check | Indicators | Bypass |
|-------|-----------|--------|
| Running processes | VBoxService.exe, vmtoolsd.exe, vmwaretray.exe | Kill or rename processes |
| Services | VBoxGuest, VMTools | Stop services; rename |
| Drivers | VBoxGuest.sys, vmci.sys | Unload drivers |
| DLLs | vboxhook.dll, vmGuestLib.dll | Rename or remove |

### 2.4 Environmental Checks

| Check | Detection | Bypass |
|-------|-----------|--------|
| Screen resolution | 800x600 or unusual | Set to 1920x1080 |
| CPU cores | 1-2 cores | Allocate 4+ cores |
| RAM | Less than 4 GB | Allocate 8+ GB |
| Disk size | Less than 60 GB | Create larger disk |
| Username | user, sandbox, malware, virus | Set realistic username |
| Computer name | SANDBOX, ANALYSIS, WIN-xxxx | Set realistic hostname |
| Recent files | Empty recent/documents | Create realistic files (use env_setup.py) |
| Uptime | Very low uptime | Run VM for a while before analysis |

## 3. Sandbox Detection Techniques

### 3.1 Behavioral

| Technique | Detection | Bypass |
|-----------|-----------|--------|
| Sleep acceleration | Calls Sleep(300000), checks actual elapsed | Don't accelerate sleep; patch sleep calls |
| User interaction | Waits for mouse/keyboard | Simulate input; use AutoIt scripts |
| File count | Checks Desktop/Documents for files | Create realistic files |
| Network test | Checks for internet access | Provide INetSim or selective access |
| USB history | Checks for USB device history | Create registry artifacts |

### 3.2 Sandbox-Specific

| Sandbox | Detection Method | Bypass |
|---------|-----------------|--------|
| Cuckoo | cuckoomon.dll, agent.py | Use modified Cuckoo; rename components |
| Any.Run | Specific window titles | N/A (cloud sandbox) |
| Joe Sandbox | joeboxcontrol.exe | N/A (cloud sandbox) |
| Windows Sandbox | Container-specific reg keys | N/A |

## 4. Anti-Disassembly Techniques

| Technique | Method | Counter |
|-----------|--------|---------|
| Opaque predicates | Always-true/false conditions | Simplify with optimization passes |
| Jump into instruction | `jmp $+1` tricks | Manual analysis; fix in disassembler |
| API hashing | Hash-based API resolution | Use HashDB plugin; build lookup table |
| Control flow flattening | Switch-based dispatch | Symbolic execution; manual reconstruction |
| Dead code insertion | Unreachable code blocks | Use program analysis to identify live code |
| String encryption | XOR/RC4 encrypted strings | Use FLOSS; write decryption script |

## 5. Recommended Tools

| Tool | Purpose | Platform |
|------|---------|----------|
| ScyllaHide | x64dbg anti-anti-debug plugin | Windows |
| TitanHide | Kernel-level debugger hiding | Windows |
| al-khaser | Anti-analysis technique tester | Windows |
| pafish | Paranoid Fish VM detection tester | Windows |
| FLOSS | Automatic string deobfuscation | Cross-platform |
| patch_anti_debug.py | Auto-patch anti-debug checks | Cross-platform |
| env_setup.py | Environment masking | Cross-platform |