Quick orientation: what is "anti-debug"?
When you attach a debugger like x64dbg, IDA, or WinDbg to a running process, the operating system changes a few small flags so the kernel knows to send debug events your way. Anti-debug techniques are just code that checks for those flags (or for the side effects of having a debugger nearby). If a check trips, the program might exit, change behavior, throw a fake error, or feed the debugger fake data to waste your time.
There are dozens of these checks, but they fall into a few families: API-based (call a Windows function that asks the OS), PEB-based (read the flags directly without calling an API), behavioral (measure how slowly the code runs), hardware-state (look at debug registers), and code-integrity (check whether the program's own code has been modified).
The catalog below covers the ten you'll meet most often. Each card includes a stealth rating (how easy it is to spot when reverse engineering the program) and a bypass difficulty rating (how easy it is to defeat once you've found it). For most beginner targets, ScyllaHide (a free x64dbg plugin) automatically handles the easy ones.
What's next after these?
The checks above are the "starter pack". Real-world anti-cheat and commercial obfuscators stack dozens of these (often custom and undocumented), combined with code obfuscation, virtual machines, and kernel-mode drivers that can see the whole system. Tools like ScyllaHide handle the well-known ones automatically; against custom checks you'll be patching them out one at a time.
Two general bypass principles to internalize:
- Patch the result, not the check. If a check returns 1 to mean "debugger detected", change the return value to 0 instead of removing the call. The code path the developer wrote for "debugger" might be the booby trap; the "no debugger" path is the one you want.
- Hook early, hook low. Hooking IsDebuggerPresent at the top of the kernel32 export gets you the API form for free; hooking it at the syscall layer (NtQueryInformationProcess) catches the direct-PEB variants too. The deeper the hook, the more techniques it kills at once.