anti-debugging-techniques

1# SKILL: Anti-Debugging Techniques — Detection & Bypass Playbook
2 
3> **AI LOAD INSTRUCTION**: Expert anti-debug techniques across Linux and Windows. Covers ptrace, PEB flags, NtQueryInformationProcess, timing attacks, signal-based detection, TLS callbacks, VEH tricks, and all corresponding bypass methods. Base models often miss the distinction between user-mode and kernel-mode detection and the correct patching strategy for each.
4 
5## 0. RELATED ROUTING
6 
7- [code-obfuscation-deobfuscation](../code-obfuscation-deobfuscation/SKILL.md) when the binary also uses control flow flattening, VM protection, or string encryption
8- [vm-and-bytecode-reverse](../vm-and-bytecode-reverse/SKILL.md) when the anti-debug sits inside a custom VM dispatcher
9- [symbolic-execution-tools](../symbolic-execution-tools/SKILL.md) when you want to symbolically skip anti-debug checks entirely
10 
11### Advanced Reference
12 
13Also load [ANTI_DEBUG_MATRIX.md](./ANTI_DEBUG_MATRIX.md) when you need:
14- Complete cross-reference matrix of technique × OS × detection method × bypass method
15- Per-technique reliability ratings and false-positive notes
16- Tool compatibility chart (GDB, x64dbg, WinDbg, Frida, ScyllaHide)
17 
18### Quick bypass picks
19 
20| Detection Class | First Bypass | Backup |
21|---|---|---|
22| ptrace-based (Linux) | `LD_PRELOAD` hook `ptrace()` → return 0 | Kernel module to hide tracer |
23| PEB.BeingDebugged (Windows) | Patch PEB byte at `fs:[0x30]+0x2` | ScyllaHide auto-patch |
24…