Anti-Debugging

Developing Applications Using The SoftwareShield System > Anti-Hacker Guide > Anti-Debugging

## Anti-Debugging

Note that the best way - by far - to protect your software is to use IronWrapping. If you own the IronWrap edition, and will be using IronWrapping in your software, these practices are unnecessary for you. This is because, the protections that IronWrapping provides, when applied at maximum strength, are at least 1000 times more powerful than the techniques you could implement yourself from descriptions in this guide.

Debuggers are tools just like your IDE that allow crackers to trace a programs execution as they are running - instruction by instruction.

There are numerous anti-debugging tricks that are documented in books and on-line, but all approach the problem from two specific angles:

1. They attempt to detect any debugger that is currently attached to the process or running in the background.

2. They attempt to detect specific debuggers (like SoftICE and others).

The SoftwareShield ClientProtector uses some sophisticated techniques to protect you from debuggers in both these ways, (see: Tamper Resistance) However, this is only effective when the ClientProtector is actually called to perform some action. To be even more resistant you should consider implementing anti-debugging tricks of your own.

There are simply too many well-documented ways to detect specific debuggers (like SoftICE) available to discuss them here. Many of them are very complex to implement or are ineffective. Instead, we suggest you make at least a simple attempt to detect debuggers. The simplest way to do this is with the Win32 API function call "IsDebuggerPresent". Although this is relatively simple to replace by most crackers, and only works on Windows NT, 2000 and XP, placing it in various unexpected locations in your program can sometimes be quite effective at slowing them down.