Makin – Reveal Anti-Debugging Tricks

makin is to make initial malware assessment little bit easier, It helps to reveal a debugger detection techniques used by a sample.

Supports x64 and x86

How does it work?
makin opens a sample as a debuggee and injects asho.dll, asho.dll hooks several functions at ntdll.dll library and after parameters checkings, it sends the corresponding message to the debugger (makin.exe).
For hooking, it uses Capstone engine, which makes hooking much stealthier.
At this moment, makin can reveal following techniques:

Note: Use The “Ultimate” Anti-Debugging Reference as a reference

 

Anastasis Vasileiadis

PC Technical || Penetration Tester || Ethical Hacker || Cyber Security Expert || Cyber Security Analyst || Information Security Researcher || Malware analyst || Malware Investigator || Reverse Engineering

Leave a Reply

SC ProDefence SRL - Cyber Security Services