Anti-debugging Framework Based on Hardware Virtualization Technology

Anti-debugging technique is widely used to protect executable files in commercial software applications. However, most of contemporary anti-debugging products fail to guarantee their functionalities in that when the application code is running on Ring 0 or above, malicious attackers can still manipulate it to block the anti-debugging process. This paper introduces an anti-debugging framework based on hardware virtualization technology called Virtual Machine Monitor (VMM), which can monitor each code running above its privilege level on Intel x86 platform. Our experiments demonstrate that major debuggers running on Microsoft Windows, such as VC2005 and WinDBG, are incapable to debug the target application with the protection of our anti-debugging framework.