IsDebuggerPresent Debugger/tool window detection Timing (rdtsc/GetTickCount) PEB BeingDebugged / NtGlobalFlag INT3 / 0xCC breakpoint scan ptrace (Linux) Exception-based (SEH/VEH/INT2D) Hardware breakpoints (DRx) NtQueryInformationProcess OutputDebugString CheckRemoteDebuggerPresent Self-debug / block debugger TLS callback Anti-dump Parent-process check Anti-attach / thread suspension DbgBreakPoint/DbgUiRemoteBreakin patch CloseHandle invalid-handle

XOR Base64 (encryption) AES (encryption) RC4 (encryption) TEA / XTEA (encryption) Substitution / table

UPX FSG ASPack MPRESS tElock VMProtect Petite Yoda ASProtect .NET Reactor ConfuserEx PECompact exepack Enigma Themida ExeCryptor WinLicense SmartAssembly Other named (Morphine/Neolite/PEtite…) PELock CodeVirtualizer PKLite MEW Dotfuscator ARM Protector BJFnt Confuser PE-PACK PyInstaller Sixxpack

MD5 CRC32 Base64 (crypto) RSA AES (crypto) SHA-256 Other / custom hash RC4 (crypto) TEA / XTEA (crypto) SHA-1 Blowfish DES / 3DES

Spaghetti / junk-branch Exception / interrupt-based Indirect / computed jumps & calls State machine / dispatcher Control-flow flattening (CFF) Return-address / stack-based

Junk / garbage bytes Malformed PE / bad bytes (UD2) Opaque predicates Overlapping / misaligned instructions Jump-based desync