What problem does it solve? Protected binaries often refuse to run under a debugger, exiting or crashing when they detect ptrace, PEB flags, timing anomalies, or exception handlers, which blocks reverse engineering and CTF analysis. This Skill provides a systematic playbook to identify each anti-debug check and apply the correct bypass. ## Core Features & Use Cases - Linux and Windows coverage: Documents ptrace self-attach, /proc/self/status TracerPid, PEB.BeingDebugged, NtQueryInformationProcess, TLS callbacks, ThreadHideFromDebugger, and timing checks with concrete bypass methods for each. - Tool-specific guidance: Provides ready-to-use bypass configurations for GDB, x64dbg with ScyllaHide, WinDbg, Frida, LD_PRELOAD shims, TitanHide, and Qiling emulation. - Decision tree and reference matrix: A symptom-based decision tree maps crash behavior to the likely check, and the companion ANTI_DEBUG_MATRIX.md cross-references technique, reliability, false positives, and tool compatibility. - Use Case: A CTF binary exits immediately under GDB. Follow the decision tree to identify a ptrace(PTRACE_TRACEME) check, then apply the LD_PRELOAD shim one-liner to continue debugging. ## Quick Start Ask the agent to analyze why the target binary exits when run under a debugger and apply the appropriate anti-debug bypass for it.
