Anti-debugging IsDebuggerPresent Debugger/tool window detection Timing (rdtsc/GetTickCount) PEB BeingDebugged / NtGlobalFlag INT3 / 0xCC breakpoint scan ptrace (Linux) Exception-based (SEH/VEH/INT2D) Hardware breakpoints (DRx) NtQueryInformationProcess OutputDebugString CheckRemoteDebuggerPresent TLS callback Anti-dump Parent-process check Anti-attach / thread suspension DbgBreakPoint/DbgUiRemoteBreakin patch CloseHandle invalid-handle String / data encryption XOR AES (encryption) RC4 (encryption) TEA / XTEA (encryption) Substitution / table Packer Other named (Morphine/Neolite/PEtite…) Code virtualization / VM Control-flow obfuscation Spaghetti / junk-branch Exception / interrupt-based Indirect / computed jumps & calls State machine / dispatcher Control-flow flattening (CFF) Return-address / stack-based Anti-disassembly Junk / garbage bytes Malformed PE / bad bytes (UD2) Opaque predicates Overlapping / misaligned instructions Jump-based desync Anti-tamper / integrity Import / API obfuscation Custom / generic obfuscation Anti-VM / sandbox Nag / trial