Antidebug detection feature

[cecio]

This will be released in version 0.4.0:

• a new emulation option will execute the provided DLL/EXE/Shellcode to identify location of anti-debug techniques

[cecio]

Implemented so far:

[#] Call to QueryPerformanceCounter() at 0x414049
[#] IsDebuggerPresent() at 0x4157e7
[#] CheckRemoteDebuggerPresent() at 0x415828
[#] Suspect NtQueryInformationProcess() at 0x4158b3
[#] Suspect NtQuerySystemInformation() at 0x415a22
[#] Direct access to PEB!BeingDebugged at 0x415a6a
[#] Direct access to PEB!NtGlobalFlag at 0x415a9e
[#] Suspect access to HeapBase (may be used to access Flags and ForceFlags) at 0x415b17
[#] GetProcAddress() of CRSS.EXE at 0x415b75
[#] Exclusive CreateFileA() on current process at 0x415bc4
[#] Call to GetLocalTime() at 0x415bfd
[#] Call to GetSystemTime() at 0x415c20
[#] Call to GetTickCount() at 0x415c52
[#] Call to QueryPerformanceCounter() at 0x415ca6
[#] Call to timeGetTime() at 0x415cd7
[#] Call to VirtualProtect() on "Return Address" at 0x4120b9

more to come...

[cecio]

This feature will be release just before https://insomnihack.ch 2022, along with some other improvements....stay tuned and come to the conference to see the talk! ;-)

[cecio]

Release 0.4.0 published