├── README.md └── research ├── hiding_call_to_ptrace ├── after_dynamic_loading.png ├── after_stripping.png ├── binja_patch.png ├── calling_library_function.png ├── gdb_ptrace_usage.png ├── hiding_call_to_ptrace.md ├── hiding_on_the_stack.png ├── import_table.png ├── imports_after_dynamic_loading.png ├── lief.png ├── link_and_strip.png ├── man_ptrace.png ├── nowap.gif ├── post_packing.png ├── pre_packing.png ├── ptrace_fail.png ├── ptrace_hidden.png ├── ptrace_in_libc.png ├── ptrace_unresolved.png ├── start_resolved.png ├── strace.png ├── strace_ptrace_usage.png ├── wax.png └── waxgone.png └── the_return_of_disassembly_desynchronization ├── correct.png ├── falsify.png ├── falsify_it.png ├── hiding_overlapped_instruction.png ├── ida_disassembly_fix.png ├── ida_fix.png ├── not_disassembled.png ├── overlapped.png ├── rogue_byte.png ├── the_return_of_disassembly_desynchronization.md └── two_rogue_bytes.png /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/README.md -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/after_dynamic_loading.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/after_dynamic_loading.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/after_stripping.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/after_stripping.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/binja_patch.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/binja_patch.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/calling_library_function.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/calling_library_function.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/gdb_ptrace_usage.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/gdb_ptrace_usage.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/hiding_call_to_ptrace.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/hiding_call_to_ptrace.md -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/hiding_on_the_stack.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/hiding_on_the_stack.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/import_table.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/import_table.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/imports_after_dynamic_loading.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/imports_after_dynamic_loading.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/lief.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/lief.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/link_and_strip.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/link_and_strip.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/man_ptrace.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/man_ptrace.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/nowap.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/nowap.gif -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/post_packing.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/post_packing.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/pre_packing.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/pre_packing.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/ptrace_fail.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/ptrace_fail.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/ptrace_hidden.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/ptrace_hidden.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/ptrace_in_libc.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/ptrace_in_libc.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/ptrace_unresolved.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/ptrace_unresolved.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/start_resolved.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/start_resolved.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/strace.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/strace.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/strace_ptrace_usage.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/strace_ptrace_usage.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/wax.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/wax.png -------------------------------------------------------------------------------- /research/hiding_call_to_ptrace/waxgone.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/hiding_call_to_ptrace/waxgone.png -------------------------------------------------------------------------------- /research/the_return_of_disassembly_desynchronization/correct.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/the_return_of_disassembly_desynchronization/correct.png -------------------------------------------------------------------------------- /research/the_return_of_disassembly_desynchronization/falsify.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/the_return_of_disassembly_desynchronization/falsify.png -------------------------------------------------------------------------------- /research/the_return_of_disassembly_desynchronization/falsify_it.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/the_return_of_disassembly_desynchronization/falsify_it.png -------------------------------------------------------------------------------- /research/the_return_of_disassembly_desynchronization/hiding_overlapped_instruction.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/the_return_of_disassembly_desynchronization/hiding_overlapped_instruction.png -------------------------------------------------------------------------------- /research/the_return_of_disassembly_desynchronization/ida_disassembly_fix.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/the_return_of_disassembly_desynchronization/ida_disassembly_fix.png -------------------------------------------------------------------------------- /research/the_return_of_disassembly_desynchronization/ida_fix.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/the_return_of_disassembly_desynchronization/ida_fix.png -------------------------------------------------------------------------------- /research/the_return_of_disassembly_desynchronization/not_disassembled.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/the_return_of_disassembly_desynchronization/not_disassembled.png -------------------------------------------------------------------------------- /research/the_return_of_disassembly_desynchronization/overlapped.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/the_return_of_disassembly_desynchronization/overlapped.png -------------------------------------------------------------------------------- /research/the_return_of_disassembly_desynchronization/rogue_byte.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/the_return_of_disassembly_desynchronization/rogue_byte.png -------------------------------------------------------------------------------- /research/the_return_of_disassembly_desynchronization/the_return_of_disassembly_desynchronization.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/the_return_of_disassembly_desynchronization/the_return_of_disassembly_desynchronization.md -------------------------------------------------------------------------------- /research/the_return_of_disassembly_desynchronization/two_rogue_bytes.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yellowbyte/analysis-of-anti-analysis/HEAD/research/the_return_of_disassembly_desynchronization/two_rogue_bytes.png --------------------------------------------------------------------------------