Anti Reversing Techniques
Unverified●30/40Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor◐PartialPlain prose you can paste in — but no Cursor rules file
Codex◐PartialPlain prose you can paste in — but no AGENTS.md
Gemini CLI◐PartialPlain prose you can paste in
Copilot◐PartialPlain prose you can paste in — but no Copilot instructions file
npx agentalley add anti-reversing-techniquesWho is stuck, and on what
Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.
The whole source
Frontmatter — 2 properties
| name | anti-reversing-techniques |
|---|---|
| description | Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments. |
| 1 | --- |
| 2 | name: anti-reversing-techniques |
| 3 | description: Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments. |
| 4 | ---A5 — No allowed-tools declared — no way to tell what this skill may touch |
| 5 | |
| 6 | > **AUTHORIZED USE ONLY**: This skill contains dual-use security techniques. Before proceeding with any bypass or analysis: |
| 7 | > |
| 8 | > 1. **Verify authorization**: Confirm you have explicit written permission from the software owner, or are operating within a legitimate security context (CTF, authorized pentest, malware analysis, security research) |
| 9 | > 2. **Document scope**: Ensure your activities fall within the defined scope of your authorization |
| 10 | > 3. **Legal compliance**: Understand that unauthorized bypassing of software protection may violate laws (CFAA, DMCA anti-circumvention, etc.) |
| 11 | > |
| 12 | > **Legitimate use cases**: Malware analysis, authorized penetration testing, CTF competitions, academic security research, analyzing software you own/have rights to |
| 13 | |
| 14 | # Anti-Reversing Techniques |
| 15 | |
| 16 | Understanding protection mechanisms encountered during authorized software analysis, security research, and malware analysis. This knowledge helps analysts bypass protections to complete legitimate analysis tasks. |
| 17 | |
| 18 | For advanced techniques, see [references/advanced-techniques.md](references/advanced-techniques.md) |
| 19 | |
| 20 | --- |
| 21 | |
| 22 | ## Input / Output |
| 23 | |
| 24 | **What you provide:** |
| 25 | |
| 26 | - **Binary path or sample**: the executable, DLL, or firmware image under analysis |
| 27 | - **Platform**: Windows x86/x64, Linux, macOS, ARM — affects which checks apply |
| 28 | - **Goal**: bypass for dynamic analysis, identify protection type, build detection code, implement for CTF |
| 29 | |
| 30 | **What this skill produces:** |
| 31 | |
| 32 | - **Protection identification**: named technique (e.g., RDTSC timing check, PEB BeingDebugged) with location in binary |
| 33 | - **Bypass strategy**: specific patch addresses, hook points, or tool commands to neutralize each check |
| 34 | - **Analysis report**: structured findings listing each protection layer, severity, and recommended bypass |
| 35 | - **Code artifacts**: Python/IDAPython scripts, GDB command sequences, or C stubs for bypassing or implementing checks |
| 36 | |
| 37 | --- |
| 38 | |
| 39 | ## Detailed patterns and worked examples |
| 40 | |
| 41 | Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient. |
| 42 | |
| 43 | ## Troubleshooting |
| 44 | |
| 45 | **Detection technique works on x86 but not ARM** |
| 46 | |
| 47 | RDTSC and CPUID are x86-only. On ARM, use `MRS x0, PMCCNTR_EL0` (requires kernel PMU access) or `clock_gettime(CLOCK_MONOTONIC)`. PEB/TEB do not exist on ARM — replace with `/proc/self/status` (Linux) or `task_info` (macOS). Rebuild detection logic with platform-specific APIs. |
| 48 | |
| 49 | **False positive on legitimate debugger or analysis tool** |
| 50 | |
| 51 | Timing checks fire when Process Monitor or AV hooks inflate syscall latency. Calibrate the threshold at startup: measure the guarded path 3 times and use `mean + 3*stddev`. For ptrace checks, verify the TracerPid comm name via `/proc/<pid>/comm` before exiting — it may be an unrelated monitoring tool, not a debugger. |
| 52 | |
| 53 | **Bypass patch causes crash instead of continuing execution** |
| 54 | |
| 55 | Before NOPing a conditional jump, trace the "detected" branch fully. If it initializes or frees heap state needed later, patching the jump skips that setup and corrupts state. Instead, patch the comparison operand to the expected "clean" value, or use x64dbg's "Set condition to always false" on the breakpoint rather than modifying bytes. |
| 56 | |
| 57 | --- |
| 58 | |
| 59 | ## Related Skills |
| 60 | |
| 61 | - `binary-analysis-patterns` — static and dynamic analysis workflows for ELF/PE/Mach-O |
| 62 | - `memory-forensics` — process memory acquisition, artifact extraction, and live analysis |
| 63 | - `protocol-reverse-engineering` — decoding custom binary protocols and encrypted network traffic |
| 64 |
Reviews
Installed this one?Write the first review and take the Trailblazer badge.
Alternatives
Block No Verify HookConfigure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.◐····●35/40Sast ConfigurationConfigure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.◐····●32/40Binary Analysis PatternsMaster binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.◐◐◐◐◐●31/40Protocol Reverse EngineeringMaster network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.◐····●30/40