恶意程序反分析绕过辅助

---
name: anti-analysis-bypass
description: Defeat malware anti-analysis defenses including anti-debugging, VM detection, sandbox evasion, and timing checks through binary patching and environment masking.
---

# Anti-Analysis Bypass

Defeat malware anti-analysis techniques to enable successful debugging and dynamic analysis. This skill covers identifying and neutralizing anti-debugging, VM detection, sandbox evasion, and timing-based checks.

## Prerequisites

- **Python 3.10+** for running patching and environment setup scripts
- **capa**: Mandiant capability scanner for identifying anti-analysis techniques
- **x64dbg** with **ScyllaHide** plugin: Debugger with anti-detection capabilities
- **TitanHide**: Kernel-level debugger hiding driver (optional)
- **Disassembler** (IDA Pro or Ghidra): For manual binary patching and analysis

## Steps

### 1. Identify Anti-Analysis Techniques

Before patching, identify which anti-analysis techniques the sample uses:

- Run `capa sample.exe` and look for capabilities under "anti-analysis" categories
- Search for known API imports: `IsDebuggerPresent`, `NtQueryInformationProcess`, `GetTickCount`, `QueryPerformanceCounter`, `NtQuerySystemInformation`
- Check for environment queries: registry reads for VM artifacts, WMI queries, hardware checks
- Consult `references/bypass-techniques.md` for a comprehensive list of techniques and indicators

### 2. Patch Anti-Debug Checks in the Binary

Use the automated patching script to neutralize common anti-debugging checks:

```bash
python3 scripts/patch_anti_debug.py --input sample.exe --output sample_patched.exe
```

Options:
- `--techniques all` (default) or specify: `isdebuggerpresent,peb,timing,ntquery`
- `--backup` creates a backup of the original (enabled by default)
- `--dry-run` shows what would be patched without modifying the file
- `--verbose` shows detailed information about each patch

See `references/binary-patching.md` for manual patching techniques.

### 3. Prepare the Analysis Environment

Make the analysis VM appear like a real user workstation:

```bash
python3 scripts/env_setup.py --profile corporate
```

This script:
- Creates realistic user files (documents, downloads, browser history)
- Sets a realistic hostname and username
- Adjusts screen resolution to common values
- Modifies MAC address prefix to non-VM vendor
- Populates recent files and registry artifacts (Windows)
- Creates running process list matching a real desktop

Profiles: `corporate`, `home`, `developer`, `minimal`

### 4. Apply Runtime Bypass Techniques

During debugging, apply these runtime techniques:

- **ScyllaHide** (x64dbg plugin): Hides debugger from most detection methods
- **TitanHide**: Kernel-level debugger hiding
- **Manually set PEB.BeingDebugged = 0**: In debugger, navigate to PEB and zero the flag

### 5. Handle Timing Checks

For timing-based anti-analysis:
- The patching script NOPs out `GetTickCount`, `QueryPerformanceCounter`, and `rdtsc` checks
- Alternatively, use the Hacker disassembler / Single-step breakpoint approach
- For `Sleep` bombs: patch `Sleep` calls to reduce or eliminate delays

### 6. Verify Bypass Effectiveness

After patching and environment setup:
1. Run the patched sample and confirm it executes its payload
2. Compare behavior with the original sample to verify no functionality was lost
3. Monitor for secondary anti-analysis checks that may trigger after the first layer

## References

- `references/bypass-techniques.md` — Anti-analysis bypass reference by technique type
- `references/binary-patching.md` — Binary patching guide for analysis