SKILL: Anti-Debugging Techniques, Detection & Bypass Playbook

AI LOAD INSTRUCTION: Expert anti-debug techniques across Linux and Windows. Covers ptrace, PEB flags, NtQueryInformationProcess, timing attacks, signal-based detection, TLS callbacks, VEH tricks, and all corresponding bypass methods. Base models often miss the distinction between user-mode and kernel-mode detection and the correct patching strategy for each.

0. RELATED ROUTING

• code-obfuscation-deobfuscation when the binary also uses control flow flattening, VM protection, or string encryption
• vm-and-bytecode-reverse when the anti-debug sits inside a custom VM dispatcher
• symbolic-execution-tools when you want to symbolically skip anti-debug checks entirely

Advanced Reference

Also load ANTI_DEBUG_MATRIX.md when you need:

• Complete cross-reference matrix of technique × OS × detection method × bypass method
• Per-technique reliability ratings and false-positive notes
• Tool compatibility chart (GDB, x64dbg, WinDbg, Frida, ScyllaHide)

Quick bypass picks

Detection Class	First Bypass	Backup
ptrace-based (Linux)	LD_PRELOAD hook ptrace() → return 0	Kernel module to hide tracer
PEB.BeingDebugged (Windows)	Patch PEB byte at fs:[0x30]+0x2	ScyllaHide auto-patch
Timing check (rdtsc)	Conditional BP after rdtsc, fix registers	Frida hook rdtsc return
IsDebuggerPresent	NOP the call / hook return 0	x64dbg built-in hide
INT 2D / UD2 exception	Set VEH to handle gracefully	TitanHide driver

---

1. LINUX ANTI-DEBUG TECHNIQUES

1.1 ptrace(PTRACE_TRACEME)

The classic self-attach: a process calls ptrace(PTRACE_TRACEME, 0, 0, 0). If a debugger is already attached, the call fails (returns -1).