anti-reversing-techniques
- Use it when:
- You hit anti-debugging, anti-VM, obfuscation or packing while analyzing a binary you're authorized to.
- It does:
- Names each protection and where it appears, then gives a specific way past it — a patch address, a hook point or a tool command.
- You get:
- Protection identification, a strategy per layer, and scripts or GDB/x64dbg command sequences; a reference file adds unpacking and virtualization-based protection.
- Authorized use:
- The skill insists on written permission or a legitimate context (malware analysis, CTF, pentest) first.
Covers bypassing software protections; intended only for malware analysis, CTFs, authorized pentests, or software you own — unauthorized circumvention may be illegal.
TL;DR
A reference for the protection mechanisms an analyst meets during authorized reverse engineering, and how to neutralize each. It opens with an authorized-use banner and an input/output contract: you give a binary, platform and goal; it produces named protections with locations, a strategy per layer, an analysis report and code artifacts. A reference file covers Windows anti-debugging (API checks, PEB flags, timing, exceptions), Linux ptrace checks, anti-VM detection (hardware fingerprints, registry and file artifacts, timing), and obfuscation (control-flow flattening, opaque predicates, string and API obfuscation). A second reference file goes further into packers and unpacking, virtualization-based protection and anti-disassembly tricks. The SKILL.md's troubleshooting notes platform differences (x86 vs ARM), calibrating timing thresholds against false positives, and adjusting a comparison rather than a jump to avoid crashes. It points to the binary-analysis-patterns, memory-forensics and protocol-reverse-engineering skills.
Summarizes the skill at 4bde316.
npx skills add https://github.com/wshobson/agents --skill anti-reversing-techniques skills.sh pageSource on GitHubAll skills from wshobson/agents
Fewer weekly downloads than 67% of skills
Weekly values
| Week to | Installs |
|---|---|
| Sep 21 | 192 |
| Sep 28 | 224 |
| Oct 5 | 299 |
| Oct 12 | 243 |
| Oct 19 | 223 |
| Oct 26 | 237 |
| Nov 2 | 212 |
| Nov 9 | 164 |
More downloads than 57% of skills
More stars than 76% of repos
Older than 82% of skills
| Category |
Compliance, guardrails, skill vetting and browser fingerprinting. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills. |
|---|---|
| Type |
Knowledge and rules the agent applies while it works: best practices, design principles, API references. |
| Effect |
Adds no side effects of its own. It shapes how the agent thinks, writes or reviews. Guidelines and routers are always effect:none, even when the task they support edits code. |
| Needs |
A specific command-line tool or desktop app must be installed, such as gh, agent-browser, LibreOffice, Obsidian or a vendor CLI. |
| Publisher |
Everyone else. Unverified vendor claims default to community. |
| Topics |
SKILL.md
From wshobson/agents at 4bde316. Checked daily, last changed Nov 6, 2026.
Frontmatter
name: anti-reversing-techniques
description: Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.AUTHORIZED USE ONLY: This skill contains dual-use security techniques. Before proceeding with any bypass or analysis:
- Verify authorization: Confirm you have explicit written permission from the software owner, or are operating within a legitimate security context (CTF, authorized pentest, malware analysis, security research)
- Document scope: Ensure your activities fall within the defined scope of your authorization
- Legal compliance: Understand that unauthorized bypassing of software protection may violate laws (CFAA, DMCA anti-circumvention, etc.)
Legitimate use cases: Malware analysis, authorized penetration testing, CTF competitions, academic security research, analyzing software you own/have rights to
Anti-Reversing Techniques
Understanding protection mechanisms encountered during authorized software analysis, security research, and malware analysis. This knowledge helps analysts bypass protections to complete legitimate analysis tasks.
For advanced techniques, see references/advanced-techniques.md
Input / Output
What you provide:
- Binary path or sample: the executable, DLL, or firmware image under analysis
- Platform: Windows x86/x64, Linux, macOS, ARM — affects which checks apply
- Goal: bypass for dynamic analysis, identify protection type, build detection code, implement for CTF
What this skill produces:
- Protection identification: named technique (e.g., RDTSC timing check, PEB BeingDebugged) with location in binary
- Bypass strategy: specific patch addresses, hook points, or tool commands to neutralize each check
- Analysis report: structured findings listing each protection layer, severity, and recommended bypass
- Code artifacts: Python/IDAPython scripts, GDB command sequences, or C stubs for bypassing or implementing checks
Detailed patterns and worked examples
Detailed pattern documentation lives in references/details.md. Read that file when the navigation tier above is insufficient.
Troubleshooting
Detection technique works on x86 but not ARM
RDTSC and CPUID are x86-only. On ARM, use MRS x0, PMCCNTR_EL0 (requires kernel PMU access) or clock_gettime(CLOCK_MONOTONIC). PEB/TEB do not exist on ARM — replace with /proc/self/status (Linux) or task_info (macOS). Rebuild detection logic with platform-specific APIs.
False positive on legitimate debugger or analysis tool
Timing checks fire when Process Monitor or AV hooks inflate syscall latency. Calibrate the threshold at startup: measure the guarded path 3 times and use mean + 3*stddev. For ptrace checks, verify the TracerPid comm name via /proc/<pid>/comm before exiting — it may be an unrelated monitoring tool, not a debugger.
Bypass patch causes crash instead of continuing execution
Before NOPing a conditional jump, trace the "detected" branch fully. If it initializes or frees heap state needed later, patching the jump skips that setup and corrupts state. Instead, patch the comparison operand to the expected "clean" value, or use x64dbg's "Set condition to always false" on the breakpoint rather than modifying bytes.
Related Skills
binary-analysis-patterns— static and dynamic analysis workflows for ELF/PE/Mach-Omemory-forensics— process memory acquisition, artifact extraction, and live analysisprotocol-reverse-engineering— decoding custom binary protocols and encrypted network traffic