mecanik / anti-debugnet

C# Anti-Debug and Anti-Dumping techniques using Win32 API functions and tricks.

Anti-DebugNET

C# Anti-Debug and Anti-Dumping techniques using Win32/NT API functions. There are certain functions/methods like the anti-dump that were created by other people.

Current Anti-Debug methods

• Check for managed debugger
• Check for unmanaged debugger
• Check for remote debugger
• Check debug port
• Detach from debugger process
• Check for kernel debugger
• Hides current process OS thread ( managed threads soon )
• Scan and Kill debuggers (ollydbg, x32dbg, x64dbg, Immunity, MegaDumper, etc)

Current Anti-Dump methods

• Erase sections - WARNING! It breaks applications which are obfuscated.

Notes

• You can use these tricks to protect your C# application, however make sure you obfuscate the code. And make no mistake, a skilled reverse engineer will easily bypass these tricks unless used properly. (see tips)
• Do not forget to remove the Console logs before simply copy/pasting files into your project ;)

Tips

• Avoid taking an immediate action, like displaying a message or crashing the application. If you take an immediate action, the cracker will know where the problematic code is located and will focus all his attention at that point, trying to figure out the root of the problem in that code.
• Avoid displaying messages saying that the application has been tampered. Instead, make a "late" crash (see below) or display a strange error message at a later point in your application.
• Produce a "late crash" or malfunction. That is, if you detect that your application has been tampered, you mark special variables (or similar action) in your code. At a later point in your application, you crash your application or initialize further structures in a wrong way, so, your application won't work as expected.

Contribution

Feel free to contribute with your own functions/methods. Just make sure you tested it properly.

Assistance

In your are in immediate need of commercial help/advice/assistance in protecting your .NET application, I can offer you my assistance for a small fee. Please do contact me via my email or if you cannot do so open an issue.

Support me

Buy me a coffee to give me more energy and write more code :)

anti-debugnet's Issues

Will the Erase Section work if the assemblies are not pre-jitted?

Thanks!

How to use

Hi. Already build this but still no idea how I can use this to my app.
Is there any tutorial?

Adding to C# Window Form.Net Application

Hi I been trying to implement this for weeks on my window form application but doesn't seem to be working at all is there other parameters i need for it to work on a C# Window Form.Net application or should it just work

Thank.

Crash function

is it possible have example of something that will crash application as you explain ? (instead use .kill()/.exit() easy to find in code)

i thought something with winapi cause unmanaged code should be better !?!?

thanks

Form app problem

My form not load if AntiDebug.DebugProtect3.HideOSThreads(); or AntiDump.DumpProtect1.AntiDump(); in the program.cs, i mean the program running in the background, but the form not visible and the proection not work like i can dump with megadumper

Is this correct?

I'd expect the DebugPort to have a valid pointer if the status was successful?
Which also then indicates the debugger port is active?

Anti-DebugNET/Anti-DebugNET/AntiDebug/DebugProtect2.cs

Line 73 in fce1a11

if (DebugPort == new IntPtr(-1))

AntiDump issue x64

Look like there is issue with AntiDump() when i force x64 solution

var dwpeheader = System.Runtime.InteropServices.Marshal.ReadInt32((IntPtr)(base_address.ToInt32() + 0x3C));
Aritmetic overflow

Is it possible to fix this function for x64 runtime?
thanks

How to use

How to use