The Problem

Developers of Windows native applications often need a sandbox to experiment with anti‑debugging tricks and to verify that their bypasses work reliably. Without a ready‑made target, each team must write a small demo that implements a variety of checks, which consumes time and introduces inconsistencies.

What This Does

The repository supplies a minimal Win32 GUI program that runs a set of anti‑debugging detectors. Each detector lives in src/Methods/ as a header‑only function (e.g., MethodIsDebuggerPresent.h, MethodNtGlobalFlag.h). The main loop in src/anti-debugging.cpp registers these callbacks through AddMethod and calls them every frame. UI rendering and input handling are delegated to the bundled Dear ImGui sources under src/imgui/. The entry‑point for the application is the Windows WinMain defined in src/anti-debugging.cpp, which creates the window, initializes ImGui, and drives the detection loop.

How It Is Wired

  • Entry point – src/anti-debugging.cpp contains int WINAPI WinMain(...). It loads resources (src/anti-debugging.rc), creates the main window, and calls ImGui::CreateContext().
  • UI layer – src/imgui/imgui.cpp and the platform back‑ends (imgui_impl_dx11.cpp, imgui_impl_win32.cpp) render the control panel. All ImGui files are large single‑header implementations; they have no external dependencies beyond the DirectX 11 and Win32 headers.
  • Method registration – AddControls in anti-debugging.cpp calls AddMethod for each header in src/Methods/. AddMethod stores a pointer to the detector function and a display name in a vector defined in src/AntiDebugMethod.cpp.
  • Detection loop – each frame the UI iterates the vector and invokes the stored callbacks. Each callback returns bool – true signals a detection, which the UI displays as “Detected”. The callbacks read system state (IsDebuggerPresent, PEB flags, CheckRemoteDebuggerPresent, timing APIs, SEH trap flag, etc.) but never touch the filesystem or network.
  • Resource handling – the resources/ folder contains icons referenced by the resource script; the binary expects the folder to be copied next to the executable, as noted in the README.
  • Dependency graph – the static analysis found zero internal import edges; the codebase is essentially a flat collection of headers and a few implementation files. The most connected files are the ImGui headers (imgui.h, imgui_internal.h, imgui_draw.cpp) because they are included throughout the UI layer.

How To Use It

  1. Build – open anti-debugging.sln with Visual Studio 2019 or newer and build the Debug or Release configuration. The solution references the DirectX 11 SDK already present on a typical Windows dev box. ``powershell # From a Developer Command Prompt msbuild anti-debugging.sln /p:Configuration=Release ``
  2. Deploy resources – copy the entire resources/ directory into the output folder (x64/Release or Win32/Debug) so the icons load at runtime.
  3. Run – execute anti-debugging.exe. The window shows a list of detectors with toggle switches. Enable any method, attach a debugger, and watch the “Detected” flag change.

If a new detector is needed, add a header under src/Methods/, implement a no‑argument bool function, and register it in AddControls as described in the README.

Real‑World Use

Security researchers can integrate this binary into an automated debugging‑bypass test harness. For example, a script can launch the program, enable a specific method via simulated UI clicks (e.g., using Win32 SendMessage), attach a chosen debugger, and verify that the detection flag flips as expected. This provides a repeatable baseline before attempting more sophisticated bypasses on target applications.

Code Health & Issues

  • High – No test suite – 10 source files, zero test files. Lack of automated verification makes regression risk high.
  • High – No CI workflow – No .github/ or other CI config. Changes are merged without any build validation.
  • High – Deep nesting – Files src/imgui/imstb_truetype.h, src/imgui/stb_image.h, src/imgui/imgui_draw.cpp have indentation depth of 11, increasing cognitive load.
  • High – Duplicated code – Repeated 6‑line blocks across 13 ImGui files; extracting shared helpers would reduce maintenance surface.
  • High – Oversized files – src/imgui/imgui.h, src/imgui/imgui_draw.cpp, src/imgui/imgui_internal.h each exceed 2 000 lines, making localized changes risky.
  • Medium – High branching density – Over 700 branch points in src/imgui/imgui.h and related files; refactoring into smaller dispatch tables is advisable.
  • Low – Numerous TODO/FIXME markers – 149 markers across ImGui headers and source files indicate unfinished work that should be triaged.

The Bottom Line

The tool delivers a functional, extensible playground for Windows anti‑debugging techniques, with clear entry points and a simple UI. However, the codebase suffers from poor modularity, no automated testing, and no CI pipeline, which limits its reliability for production‑grade reverse‑engineering work. It is best suited for hobbyists or researchers who are comfortable navigating large, monolithic C++ sources and can add the missing quality‑assurance scaffolding.