Agent skill · security · yaklang
anti-debugging-techniques
Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/exception handlers on Linux and Windows.
Why this skill is useful
Adds detailed anti-debugging techniques and executable bypass methods that are not commonly known or documented.
What it needs
Requires frida, gdb, scyllahide, windbg, x64dbg installed locally. About 8k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Anti-Debugging Techniques — Detection & Bypass Playbook AI LOAD INSTRUCTION: Expert anti-debug techniques across Linux and Windows. Covers ptrace, PEB flags, NtQueryInformationProcess, timing attacks, signal-based detection, TLS callbacks, VEH tricks, and all corresponding bypass methods. Base models often miss the distinction between user-mode and kernel-mode detection and the correct patching strategy for each. 0. RELATED ROUTING code-obfuscation-deobfuscation when the binary also uses control flow flattening, VM protection, or string encryption vm-and-bytecode-reverse when the anti-debug sits inside a custom VM dispatcher symbolic-execution-tools when you want to symbolically skip anti-debug checks entirely Advanced Reference Also load ANTIDEBUGMATRIX.md when you need: Complete cross-reference matrix of technique × OS × detection method × bypass method Per-technique reliability ratings and false-positive notes Tool compatibility chart (GDB, x64dbg, WinDbg, Frida, ScyllaHide) Quick bypass picks Detection Class First Bypass Backup --- --- --- ptrace-based (Linux) LDPRELOAD hook ptrace() → return 0 Kernel module to hide tracer PEB.BeingDebugged (Windows) Patch PEB byte at fs:[0x30]+0x2 ScyllaHide auto-patch Timing check (rdtsc) Conditional BP after rdtsc, fix registers Frida hook rdtsc return IsDebuggerPresent NOP the call / hook return 0 x64dbg built-in hide INT 2D / UD2 exception Set VEH to handle gracefully TitanHide driver --- 1. LINUX ANTI-DEBUG TECHNIQUES 1.1 ptrace(PTRACETRACEME) The classic self-attach: a process calls ptrace(PTRACETRACEME, 0, 0, 0). If a debugger is already attached, the call fails (returns -1). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/anti-debugging-techniques