Submit a plugin
Back to the list
AntiDebugSeeker
v1.0
  • Released on: 2023-09-22
Download
SHA256 checksum:
7b32812128eaab55a428474e1df5308fe0b3bf07eb31467f3fd6383724723c45

The main functionalities of this plugin are as follows:

  • Extraction of Windows API that are potentially being used for anti-debugging by the malware
    (All subsequent API represent the Windows API)
  • In addition to API, extraction of anti-debugging techniques based on key phrases that serve as triggers, as some anti-debugging methods cannot be comprehensively identified by API calls alone.

Additionally, the file that defines the detection rules is designed to easily add keywords you want to detect.
This allows analysts to easily add new detection rules or make changes.

For packed malware, running this plugin after unpacking and fixing the Import Address Table is more effective.

Please check the detailed information at the following URL.

https://github.com/LAC-Japan/IDA_Plugin_AntiDebugSeeker