Code Monkey home page Code Monkey logo

cpp-anti-debug's Introduction

cpp-anti-debug

a c++ library that offers debugger detection.

getting started

these instructions will get you a copy of the project up and running on your local machine for development and testing purposes.

literally download & include

you can then use

#include anti_debug.hpp

//will return security::internal::debug_results::none if no debuggers etc. were found, returns the specific code if something was found
//see anti_debug.hpp for more information
if(security::check_security() != security::internal::debug_results::none) {
  std::cout << "security check was not successful." << std::endl;
}

features

string encryption to prevent static anlysis, strings get returned from one central function (if possible) the library features the following functions (in-depth explanation for most of them is in the code): alternatively you can use the big function check_security() to run all checks.

		namespace memory {
			int being_debugged_peb();
			int remote_debugger_present();
			int check_window_name();
			int is_debugger_present();
			int nt_global_flag_peb();
			int nt_query_information_process();
			int nt_set_information_thread();
			int debug_active_process(const char*);
			int write_buffer();
		}

		namespace exceptions {
			int close_handle_exception();
			int single_step_exception();
			int int_3();
			int int_2d();
			int prefix_hop();
			int debug_string();
		}

		namespace timing {
			int rdtsc();
			int query_performance_counter();
			int get_tick_count();
		}

		namespace cpu {
			int hardware_debug_registers();
			int mov_ss();
		}

todo:

add virtualization and sandboxing checks to prevent your files from being executed in virtualized environments or sandboxes

add detections for dumping tools

notes:

it's recommended to run the check multiple times (once every X seconds etc.)

you will need to come up with the "xor_cc.hpp" yourself, it's a generic precompiler instruction that replaces xor("string") with a call to a generic xor function and passes the result of the first call to it (strings get unencrypted at runtime). you should be able to figure this out yourself.

contributing

please create a pull request if you have made another check and want to include it or create an issue if you want me to add another check.

versioning

no versions but updates (sometimes)

authors

  • John 'cetfor' Toterhi - initial work on the stuffs - GitHub
  • Robert 'BaumFX' - refactored, commented stuff and added stuff - website - GitHub

license

its like (insert current line amount) lines but dont say you made it, okay?

cpp-anti-debug's People

Contributors

baumfx avatar m417z avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

cpp-anti-debug's Issues

EXE Crash

Hi,BaumFX.
In X32 Debug or Relese.
When I run the code by VisualStudio2022, it is normal.
But when I only run the exe,it will crash.
I'm not changing any codes ,so I can't understand it.
Can you help me?
Thank you!

Window class names for more tools

x32/x64dbg use the same as IDA Pro (Both are QT applications, and this could cause a lot of false positives)

WindowsForms10.Window.8.app.0.2bf8098_r6_ad1 - Fiddler
Fiddler is a windows form, which means it shares a class name with a lot of other windows forms apps
To bypass fiddler, set the proxy to null before sending an http request

XTPMainFrame - HTTPDebugger
SunAwtFrame - Charles Web Debugging Proxy
these are also shared by other programs

using class names can cause a lot of false positives though

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.